Ensure No World Writable Folders Exist in the System Folder

HochStufe 1Automatisiertmacos

Beschreibung

Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions. Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a persistent presence on the system. Folders in /System/Volumes/Data/System should not be world-writable. The audit check excludes the downloadDir and locks folders that are part of Apple's default user template.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

[ -d /System/Volumes/Data/System ] || exit 1
/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs

Erwartete Ausgabe: 0

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Terminal Method: Run the following command to set permissions so that folders are not world-writable in the /System folder: % IFS=$'\n' for sysPermissions in $( /usr/bin/sudo /usr/bin/find /System/Volumes/Data/System -type d -perm -2 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" ); do /bin/chmod -R o-w "$sysPermissions" done

Eigenschaften

Betriebssysteme: macos-14
Tags: macossonoma
Referenz: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.1.6 Ensure No World Writable Folders Exist in the System Folder

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target macos