os_newsyslog_files_*_configure don't take /etc/newsyslog.d into account #119

New Issue

michael · 2026-01-19T18:29:18Z

michael commented

2026-01-19 18:29:18 +00:00

Originally created by @nihil-admirari on GitHub.

Originally assigned to: @brodjieski on GitHub.

os_newsyslog_files_owner_group_configure and os_newsyslog_files_permissions_configure get the list of files via:

/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }')

Files inside /etc/newsyslog.d are ignored.

Also, ownership and mode can be configured directly within newsyslog.conf files via the optional second and third columns, though it may not be a good idea since e.g. /etc/newsyslog.d/com.apple.xscertd.conf explicitly sets ownership to _ces:admin.

Suggestions

zsh globbing is used to handle log rotation, but I don't have any log-rotated files on my machine to verify.

Checking for ownership:

logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*})
own_err=("${(fu)^logfiles}"*(N^u[root],^g[wheel]))
echo "${#own_err}"

Fixing ownership:

logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*})
/usr/sbin/chown root:wheel "${(fu)^logfiles}"*(N^u[root],^g[wheel])

Checking for permissions:

logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*})
perm_err=("${(fu)^logfiles}"*(N^f0640))
echo "${#perm_err}"

Fixing permissions:

logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*})
/bin/chmod 640 "${(fu)^logfiles}"*(N^f0640)

Checking ownership misconfiguration:

/usr/bin/awk -v err=0 '
    !/^#/ {
        if ($2 ~ /^[[:digit:]]+$/ || $2 != "root:wheel") {
            ++err
        }
    }
    END { print err }
' /etc/newsyslog.{conf,d/*}

Fixing ownership misconfiguration:

/usr/bin/sed -Ei 's,^([^#][^[:space:]]+[[:space:]]+)([^[:space:]]+:[^[:space:]]+)?,\1root:wheel ,' /etc/newsyslog.{conf,d/*}

Checking permissions misconfiguration:

/usr/bin/awk -v err=0 '
    !/^#/ {
        i = $2 ~ /^[[:digit:]]+$/ ? 2 : 3
        if ($i != "640") { ++err }
    }
    END { print err }
' /etc/newsyslog.{conf,d/*}

Fixing permissions misconfiguration:

/usr/bin/sed -Ei 's,^([^#][^[:space:]]+[[:space:]]+([^[:space:]]+:[^[:space:]]+)?[[:space:]]+)[[:digit:]]+,\1640,' /etc/newsyslog.{conf,d/*}

Changes can be inspected by running diff in a loop:

for f in /etc/newsyslog.{conf,d/*}; do
    diff --color=always --unified "$f" <(/usr/bin/sed -E 'SED COMMAND GOES HERE' "$f")
done

Originally created by @nihil-admirari on GitHub. Originally assigned to: @brodjieski on GitHub. [os_newsyslog_files_owner_group_configure](https://github.com/usnistgov/macos_security/blob/sonoma/rules/os/os_newsyslog_files_owner_group_configure.yaml) and [os_newsyslog_files_permissions_configure](https://github.com/usnistgov/macos_security/blob/sonoma/rules/os/os_newsyslog_files_permissions_configure.yaml) get the list of files via: ```sh /usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') ``` Files inside `/etc/newsyslog.d` are ignored. Also, ownership and mode can be configured directly within `newsyslog.conf` files via the optional second and third columns, though it may not be a good idea since e.g. `/etc/newsyslog.d/com.apple.xscertd.conf` explicitly sets ownership to `_ces:admin`. ### Suggestions zsh globbing is used to handle log rotation, but I don't have any log-rotated files on my machine to verify. Checking for ownership: ```sh logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*}) own_err=("${(fu)^logfiles}"*(N^u[root],^g[wheel])) echo "${#own_err}" ``` Fixing ownership: ```sh logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*}) /usr/sbin/chown root:wheel "${(fu)^logfiles}"*(N^u[root],^g[wheel]) ``` Checking for permissions: ```sh logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*}) perm_err=("${(fu)^logfiles}"*(N^f0640)) echo "${#perm_err}" ``` Fixing permissions: ```sh logfiles=$(/usr/bin/awk '!/^#/ { print $1 }' /etc/newsyslog.{conf,d/*}) /bin/chmod 640 "${(fu)^logfiles}"*(N^f0640) ``` Checking ownership misconfiguration: ```sh /usr/bin/awk -v err=0 ' !/^#/ { if ($2 ~ /^[[:digit:]]+$/ || $2 != "root:wheel") { ++err } } END { print err } ' /etc/newsyslog.{conf,d/*} ``` Fixing ownership misconfiguration: ```sh /usr/bin/sed -Ei 's,^([^#][^[:space:]]+[[:space:]]+)([^[:space:]]+:[^[:space:]]+)?,\1root:wheel ,' /etc/newsyslog.{conf,d/*} ``` Checking permissions misconfiguration: ```sh /usr/bin/awk -v err=0 ' !/^#/ { i = $2 ~ /^[[:digit:]]+$/ ? 2 : 3 if ($i != "640") { ++err } } END { print err } ' /etc/newsyslog.{conf,d/*} ``` Fixing permissions misconfiguration: ```sh /usr/bin/sed -Ei 's,^([^#][^[:space:]]+[[:space:]]+([^[:space:]]+:[^[:space:]]+)?[[:space:]]+)[[:digit:]]+,\1640,' /etc/newsyslog.{conf,d/*} ``` Changes can be inspected by running `diff` in a loop: ```sh for f in /etc/newsyslog.{conf,d/*}; do diff --color=always --unified "$f" <(/usr/bin/sed -E 'SED COMMAND GOES HERE' "$f") done ```

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#119