NixOS syslog log directory must have a mode of 0750 or less permissive.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-268117 | SRG-OS-000057-GPOS-00027 | ANIX-00-000590 | SV-268117r1039239_rule | 2024-10-25 | 1 |
| Description |
|---|
| Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit NixOS system activity. |
| ℹ️ Check |
|---|
| Verify NixOS protects audit information from unauthorized read access by implementing a mode of 0750 or less on the creation of log directories with the following command: $ cat $(egrep -o 'cfgfile=.*\.conf' $(nix-store --query --requisites /run/current-system | grep syslog-ng.service)/syslog-ng.service | awk -F '=' '{print $2}') | grep dir_perm dir_perm(0750); If the syslog log directory is not a mode of 0750 or less permissive, this is a finding. |
| ✔️ Fix |
|---|
| Configure the syslog-ng service to create log directories with a mode of "0750" or less permissive. Note: By specifying these configurations in the "options" sections, these configurations apply globally and take effect when these configuration options are not specified later on specific file-based destinations. If there are also related configurations specified at the destination level, these will either need to be updated or removed such that the global specifications apply. Add or update the "services.syslog-ng.extraConfig" configuration in /etc/nixos/configuration.nix to include the following: services.syslog-ng.extraConfig = '' options { dir_perm(0750); }; ''; Rebuild the NixOS configuration with the following command: $ sudo nixos-rebuild switch |