Ensure Automatic Opening of Safe Files in Safari Is Disabled

MediumLevel 1Automatedmacos

Description

Safari will automatically run or execute what it considers safe files. This can include installers and other files that execute on the operating system. Safari evaluates file safety by using a list of filetypes maintained by Apple. The list of files include text, image, video and archive formats that would be run in the context of the OS rather than the browser.

How it is checked

Audit method: Shell command

shell

out=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -E 'AutoOpenSafeDownloads' | /usr/bin/tr -d ' '

Expected output: AutoOpenSafeDownloads=0;

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.Safari AutoOpenSafeDownloads = <false/>.

Properties

Operating systems: macos-15
Tags: macosapplications
Reference: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 6.3.1 Ensure Automatic Opening of Safe Files in Safari Is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos