Apple OS X 10.13 Security Technical Implementation Guide

The Apple OS X 10.13 Security Technical Implementation Guide (V2 R5) has 135 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

135STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R5

CurrentPublished Wed Apr 27 2022

The macOS system must be configured with access control lists (ACLs) for system log files to be set correctly.

Apple OS X 10.13 Security Technical Implementation Guide

Assessment Title

Rule Text

The macOS system must be configured with access control lists (ACLs) for system log files to be set correctly.

Description

Discussion Text

System logs should only be readable by root or admin users. System logs frequently contain sensitive information that could be used by an attacker. Setting the correct ACLs mitigates this risk.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-214931

Rule

SV-214931r609363_rule

Severity

medium

Rule Version

AOSX-13-002107

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

These commands check for log files that exist on the system and print out the list of ACLs if there are any.

/usr/bin/sudo ls -ld@ $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | awk '{ print $1 }') 2> /dev/null
/usr/bin/sudo ls -ld@ $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | awk '{ print $2 }') 2> /dev/null

ACLs will be listed under any file that may contain them (i.e., "0: group:admin allow list,readattr,reaadextattr,readsecurity").

If any system log file contains this information, this is a finding.

Implementation Procedure

Fix Text

For any log file that returns an ACL, run the following command:

/usr/bin/sudo chmod -N [log file]

[log file] is the full path to the log file in question.

STIG check 126 of 135 in the Apple OS X 10.13 STIG checklist

← Previous · V-214930The macOS system must be configured with system log files set to mode 640 or less permissive.Next · V-214932 →The macOS system must audit the enforcement actions used to restrict access associated with changes to the system.