documentation_complete: true

title: 'System Audit Logs Must Have Mode 0640 or Less Permissive'

description: |-
    If <tt>log_group</tt> in <tt>/etc/audit/auditd.conf</tt> is set to a group other than the <tt>root</tt>
    group account, change the mode of the audit log files with the following command:
    <pre>$ sudo chmod 0640 <i>audit_file</i></pre>
    <br />
    Otherwise, change the mode of the audit log files with the following command:
    <pre>$ sudo chmod 0600 <i>audit_file</i></pre>

rationale: 'If users can write to audit logs, audit trails can be modified or destroyed.'

severity: unknown

identifiers:
    cce: 27243-5

references:
    disa: 166
    nist: AC-6,AU-1(b),AU-9,IR-5
    pcidss: Req-10.5
    srg: SRG-OS-000058
    stigid: RHEL-06-000383

ocil_clause: 'any are more permissive'

ocil: |-
    Run the following command to check the mode of the system audit logs:
    <pre>$ sudo ls -l /var/log/audit</pre>
    Audit logs must be mode 0640 or less permissive.
