OAuth Audit Logs Must Be Owned By Root

Description

All audit logs must be owned by root user and group. By default, the path for the OAuth audit log is

/var/log/oauth-apiserver/

. To properly set the owner of /var/log/oauth-apiserver, run the command:

$ sudo chown root /var/log/oauth-apiserver 

To properly set the owner of /var/log/oauth-apiserver/*, run the command:

$ sudo chown root /var/log/oauth-apiserver/* 

Rationale

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.