OpenControls Logo

STIG Viewer

STIGViewer Support

The operating system must protect the audit records resulting from non-local accesses to privileged accounts and the execution of privileged functions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-219985SOL-11.1-070250SV-219985r958732_ruleCCI-002234medium
Description
Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable when performed by an operating system which the user being audited has privileged access to. The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.
STIGDate
Solaris 11 SPARC Security Technical Implementation Guide2026-05-13

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.4Auditing Use of Privileged Functions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(3)Changes by Authorized Individuals
1.00

+24 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI1 mapping
CCI-002234
1.00

Details

Check Text (C-219985r958732_chk)

The audit configuration profile is required. This check applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. Determine the location of the local audit trail files. # auditconfig -getplugin audit_binfile Plugin: audit_binfile (active) Attributes: p_dir=/var/audit;p_fsize=4M;p_minfree=1;" In this example, the audit files can be found in /var/audit. Check that the permissions on the audit files are 640 (rw- r-- --) or less permissive. # ls -al /var/audit # ls -l /var/audit/* If the permissions are more permissive than 640, this is a finding. Note: The default Solaris 11 location for /var/audit is a link to /var/share/audit.

Fix Text (F-21694r371409_fix)

The root role is required. Determine the location of the local audit trail files. # pfexec auditconfig -getplugin audit_binfile Plugin: audit_binfile (active) Attributes: p_dir=/var/audit;p_fsize=4M;p_minfree=1 In this example, the audit files can be found in /var/audit. Change the permissions on the audit trail files and the audit directory. # chmod 640 /var/share/audit/* # chmod 750 /var/share/audit Note: The default Solaris 11 location for /var/audit is a link to /var/share/audit.