System Audit Logs Must Be Owned By Root

Description

All audit logs must be owned by root user and group. By default, the path for audit log is

/var/log/audit/

. To properly set the owner of /var/log/audit, run the command:

$ sudo chown root /var/log/audit 

To properly set the owner of /var/log/audit/*, run the command:

$ sudo chown root /var/log/audit/* 

Rationale

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.