TMA-MACOS-1.5

Ensure Install Security Responses and System Files Is Enabled

HochStufe 1Automatisiertmacos

Beschreibung

Ensure that system and security updates are installed after they are available from Apple. This setting enables definition updates for XProtect and Gatekeeper. With this setting in place, new malware and adware that Apple has added to the list of malware or untrusted software will not execute. These updates do not require reboots or end user admin rights.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('ConfigDataInstall'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('CriticalUpdateInstall'))
  if ( pref1 == 1 && pref2 == 1 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Erwartete Ausgabe: true

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Profile (preferred): com.apple.SoftwareUpdate ConfigDataInstall = <true/>; com.apple.SoftwareUpdate CriticalUpdateInstall = <true/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true. GUI: System Settings > General > Software Update > i > Set Install Security Responses and System files to enabled > Done.

Eigenschaften

Betriebssysteme: macos-26
Tags: macossoftware-update
Referenz: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.5 Ensure Install Security Responses and System Files Is Enabled

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target macos