System Audit Logs Must Have Mode 0640 or Less Permissive

Description

If log_group in /etc/audit/auditd.conf is set to a group other than the root group account, change the mode of the audit log files with the following command:

$ sudo chmod 0640 audit_file
       

Otherwise, change the mode of the audit log files with the following command:

$ sudo chmod 0600 audit_file
       

Rationale

If users can write to audit logs, audit trails can be modified or destroyed.