← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22370

CAT III (Low)

System audit tool executables must be owned by root.

Rule ID

SV-45272r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-001493

Discussion

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Check Content

Verify the audit tool executables are owned by root.
# ls -l /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd 
If any listed file is not owned by root, this is a finding.

Fix Text

Change the owner of the audit tool executable to root.
# chown root [audit tool executable]