---
id: os_newsyslog_files_owner_group_configure
title: Configure System Log Files Owned by Root and Group to Wheel
discussion: |
  The system log files _MUST_ be owned by root.

  System logs contain sensitive data about the system and users. If log files are set to only be readable and writable by system administrators, the risk is mitigated.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95233-3
      macos_15:
        - CCE-94233-4
      macos_14:
        - CCE-92829-1
    800-53r5:
      - SI-11
  disa:
    cci:
      - CCI-001312
      - CCI-001314
    srg:
      - SRG-OS-000206-GPOS-00084
      - SRG-OS-000205-GPOS-00083
    disa_stig:
      macos_26:
        - APPL-26-004030
      macos_15:
        - APPL-15-004030
      macos_14:
        - APPL-14-004030
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    '15.0':
      benchmarks:
        - name: disa_stig
          severity: medium
    enforcement_info:
      check:
        shell: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' '
        result:
          integer: 0
      fix:
        shell: /usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - cnssi-1253_low
  - cnssi-1253_high
  - cnssi-1253_moderate
