SV-258165r958434: RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access. | Red Hat Enterprise Linux 9 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.

Description

Discussion Text

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000162Not mappedCCI-000163Not mappedCCI-000164Not mappedCCI-001314

References

DPMS Target Red Hat Enterprise Linux 9 DISA DPMS Target Red Hat Enterprise Linux 9 5551

Checks

DISA STIG (Manual Reference)

Verify the audit logs are group-owned by "root" or a restricted logging group. 

First determine if a group other than "root" has been assigned to the audit logs with the following command:

$ sudo grep log_group /etc/audit/auditd.conf

Then determine where the audit logs are stored with the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log

Then using the location of the audit log file, determine if the audit log is group-owned by "root" using the following command:

$ sudo stat -c "%G %n" /var/log/audit/audit.log

root /var/log/audit/audit.log

If the audit log is not group-owned by "root" or the configured alternative logging group, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel9os:def:258165
if [ ! -f "/etc/audit/auditd.conf" ]; then echo "PASS"; exit 0; fi
if ! grep -qP '^\s*log_file\s*=\s*(\S+)\s*$' /etc/audit/auditd.conf; then echo "PASS"; exit 0; fi
GROUP=$(grep -P '^\s*log_file\s*=\s*(\S+)\s*$' /etc/audit/auditd.conf | sed -r's/^\s*log_file\s*=\s*([^\s]+).*/\1/')
if [ -z "$GROUP" ]; then echo "FAIL"; exit 1; fi
if [ ! -d "/var/log/audit" ]; then echo "PASS"; exit 0; fi
if [ ! -f "/proc/self/cwd" ]; then echo "FAIL"; exit 1; fi
if [ $(stat -c "%G" /var/log/audit) = "$GROUP" ] && [ $(stat -c "%g" /var/log/audit) = "0" ]; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi

Remediation

Change the group of the directory of "/var/log/audit" to be owned by a correct group.

Identify the group that is configured to own audit log:

$ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf

Change the ownership to that group:

$ sudo chgrp ${GROUP} /var/log/audit