Restrict access to the audit logs

Description

auditd writes its logs to /var/log/audit/. This control requires:

• the directory owned by root, mode 0750 or stricter;
• every file in it owned by root, mode 0640 or stricter;
• every file in it owned by group root or by the log_group of /etc/audit/auditd.conf (adm on Debian), so that only that group can read them.

The control assumes the default log_file = /var/log/audit/audit.log.

Rationale

The audit trail is evidence of what users did. If users can read it they learn what is monitored; if anyone but auditd can write it, it can be falsified.

Impact

None known. Debian already creates the directory and files with these permissions.

Setting

Audit

1. Run stat -c '%n %U:%G %a' /var/log/audit /var/log/audit/*.
2. The directory must be owned by root with mode 0750 or stricter; each file owned by root with mode 0640 or stricter, and group root or the log_group of /etc/audit/auditd.conf.

Automated: every check must pass. Scanners report each check by its id.

directory

Owner and mode of /var/log/audit.

path: /var/log/audit
owner: root
mode: '0750'

files

Owner and mode of the audit log files.

path: /var/log/audit/*
owner: root
mode: '0640'

group

Group of the audit log files, compared with log_group.

script: |
  [ -d /var/log/audit ] || exit 2
  g=$(sed -n 's/^[[:space:]]*log_group[[:space:]]*=[[:space:]]*\([^[:space:]]*\).*/\1/p' /etc/audit/auditd.conf 2>/dev/null | tail -n 1)
  g=${g:-root}
  bad=$(find /var/log/audit -type f ! -group root ! -group "$g" 2>/dev/null)
  echo "log_group=$g${bad:+, other group on: $bad}"
  [ -z "$bad" ]

Remediation

Run chown root /var/log/audit /var/log/audit/*, chmod 750 /var/log/audit, chmod 640 /var/log/audit/* and chgrp <log_group> /var/log/audit/*.

Rollback

No rollback needed; these are the Debian defaults.

directory

Generated from check directory: the engine writes the fix for every output, it sets the expected value and the check runs again after.

files

Generated from check files: the engine writes the fix for every output, it sets the expected value and the check runs again after.

group

g=$(sed -n 's/^[[:space:]]*log_group[[:space:]]*=[[:space:]]*\([^[:space:]]*\).*/\1/p' /etc/audit/auditd.conf 2>/dev/null | tail -n 1)
g=${g:-root}
[ -d /var/log/audit ] || exit 0
find /var/log/audit -type f ! -group root ! -group "$g" -exec chgrp "$g" {} +

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• auditd.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-011 Install and run the audit daemon

People and lifecycle