id: audit_acls_files_configure
title: Configure Audit Log Files to Not Contain Access Control Lists
discussion: |
  The audit log files _MUST_ not contain access control lists (ACLs).

  This rule ensures that audit information and audit files are configured to be readable and writable only by system administrators, thereby preventing unauthorized access, modification, and deletion of files.
check: |
  /bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":"
result:
  integer: 0
fix: |
  [source,bash]
  ----
  /bin/chmod -RN /var/audit
  ----
references:
  cce:
    - CCE-95101-2
  cci:
    - CCI-000162
    - CCI-000163
    - CCI-000164
    - CCI-001314
    - CCI-001493
    - CCI-001494
    - CCI-001495
  800-53r5:
    - AU-9
  800-53r4:
    - AU-9
  srg:
    - SRG-OS-000256-GPOS-00097
    - SRG-OS-000057-GPOS-00027
    - SRG-OS-000059-GPOS-00029
    - SRG-OS-000257-GPOS-00098
    - SRG-OS-000258-GPOS-00099
    - SRG-OS-000058-GPOS-00028
  disa_stig:
    - APPL-26-000030
  800-171r3:
    - 03.03.08
  cis:
    benchmark:
      - 3.5 (level 1)
    controls v8:
      - 3.3
  cmmc:
    - AU.L2-3.3.8
  bio:
    - 8.18.02
macOS:
  - '26.0'
tags:
  - 800-53r5_low
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
  - cnssi-1253_high
  - nlmapgov_base
  - nlmapgov_plus
severity: medium
mobileconfig: false
mobileconfig_info:
