TMA-MACOS-5.1.6
Ensure No World Writable Folders Exist in the System Folder
Descripción
Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions. Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a persistent presence on the system.
Cómo se verifica
Método de auditoría: Comando de shell
[ -d /System/Volumes/Data/System ] || exit 1
/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs- Salida esperada
0
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Terminal: IFS=$'\n' for sysPermissions in $( sudo /usr/bin/find /System/Volumes/Data/System -type d -perm -2 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" ); do /bin/chmod -R o-w "$sysPermissions" done.
Propiedades
- Sistemas operativos
- macos-26
- Etiquetas
- macossystem-access
- Referencia
- CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.1.6 Ensure No World Writable Folders Exist in the System Folder
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target macos