STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files.

DISA Rule

SV-260599r958434_rule

Vulnerability Number

V-260599

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

UBTU-22-653055

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Configure the group owner of newly created audit logs to be "root".

Add or modify the following lines in the "/etc/audit/auditd.conf " file:

log_group = root

Reload the configuration file of the audit service to update the group ownership of existing files:

$ sudo systemctl kill auditd -s SIGHUP

Check Contents

Verify the group owner of newly created audit logs is "root" by using the following command:

$ sudo grep -iw log_group /etc/audit/auditd.conf
log_group = root

If "log_group" is not set to "root", this is a finding.

Vulnerability Number

V-260599

Documentable

False

Rule Version

UBTU-22-653055

Severity Override Guidance

Verify the group owner of newly created audit logs is "root" by using the following command:

$ sudo grep -iw log_group /etc/audit/auditd.conf
log_group = root

If "log_group" is not set to "root", this is a finding.

Check Content Reference

M

Target Key

5594