V-22702

Discussion

Sensitive system and user information could provide a malicious user with enough information to penetrate further into the system.

Check Content

Check the group ownership of the audit logs.

Procedure:
# (audit_log_file=$(grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//) && if [ -f "${audit_log_file}" ] ; then printf "Log(s) found in "${audit_log_file%/*}":\n"; ls -l ${audit_log_file%/*}; else printf "audit log file(s) not found\n"; fi)
If any audit log file is not group-owned by root, bin, sys, or system, this is a finding.