Shutdown System When Auditing Failures Occur
An XCCDF Rule
Description
The macOS system must shut down by default upon audit failure unless availability is an overriding concern.
Rationale
The audit service should shut down the computer if it is unable to audit system events. Once audit failure occurs, user and system activity is no longer recorded and malicious activity could go undetected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode.
- ID
- xccdf_org.ssgproject.content_rule_audit_failure_halt
- Severity
- Medium
- References
- Updated
Remediation - Shell Script
/usr/bin/sed -i.bak '/^policy/ s/$/,ahlt/' /etc/security/audit_control; sudo /usr/sbin/audit -s