---
id: audit_acls_files_configure
title: Configure Audit Log Files to Not Contain Access Control Lists
discussion: |
  The audit log files _MUST_ not contain access control lists (ACLs).

  This rule ensures that audit information and audit files are configured to be readable and writable only by system administrators, thereby preventing unauthorized access, modification, and deletion of files.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95101-2
      macos_15:
        - CCE-94101-3
      macos_14:
        - CCE-92701-2
    800-53r5:
      - AU-9
    800-171r3:
      - 03.03.08
  disa:
    cci:
      - CCI-000162
      - CCI-000163
      - CCI-000164
      - CCI-001314
      - CCI-001493
      - CCI-001494
      - CCI-001495
    srg:
      - SRG-OS-000256-GPOS-00097
      - SRG-OS-000057-GPOS-00027
      - SRG-OS-000059-GPOS-00029
      - SRG-OS-000257-GPOS-00098
      - SRG-OS-000258-GPOS-00099
      - SRG-OS-000058-GPOS-00028
    disa_stig:
      macos_26:
        - APPL-26-000030
      macos_15:
        - APPL-15-000030
      macos_14:
        - APPL-14-000030
    cmmc:
      - AU.L2-3.3.8
  bzk:
    bio:
      - 8.18
      - 8.18.02
  cis:
    benchmark:
      macos_26:
        - 3.5 (level 1)
      macos_15:
        - 3.5 (level 1)
      macos_14:
        - 3.5 (level 1)
    controls_v8:
      - 3.3
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
        - name: nlmapgov_base
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
        - name: nlmapgov_base
    enforcement_info:
      check:
        shell: '/bin/ls -le $(/usr/bin/grep ''^dir'' /etc/security/audit_control | /usr/bin/awk -F: ''{print $2}'') | /usr/bin/awk ''{print $1}'' | /usr/bin/grep -c ":"'
        result:
          integer: 0
      fix:
        shell: /bin/chmod -RN /var/audit
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cmmc_lvl2
  - cnssi-1253_moderate
  - cnssi-1253_high
