NixOS syslog log directory must have a mode of 0750 or less permissive.
An XCCDF Rule
Description
Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit NixOS system activity.
- ID
- SV-268117r1039239_rule
- Version
- ANIX-00-000590
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the syslog-ng service to create log directories with a mode of "0750" or less permissive.
Note: By specifying these configurations in the "options" sections, these configurations apply globally and take effect when these configuration options are not specified later on specific file-based destinations. If there are also related configurations specified at the destination level, these will either need to be updated or removed such that the global specifications apply.
Add or update the "services.syslog-ng.extraConfig" configuration in /etc/nixos/configuration.nix to include the following: