Ensure Appropriate Permissions Are Enabled for System Wide Applications

AltaNivel 1Automatizadamacos

Descripción

Applications in the System Applications Directory (/Applications) should be world- executable since that is their reason to be on the system. They should not be world- writable and allow any process or user to alter them for other processes or users to then execute modified versions. Some application vendors use a world-writable folder for their applications. This is against the standard practice on POSIX systems.

Cómo se verifica

Método de auditoría: Comando de shell

shell

[ -d /System/Volumes/Data/Applications ] || exit 1
/usr/bin/find /System/Volumes/Data/Applications -iname "*.app" -type d -perm -2 -ls 2>/dev/null | /usr/bin/grep -v Xcode.app | /usr/bin/wc -l | /usr/bin/xargs

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: IFS=$'\n' for apps in $( sudo /usr/bin/find /System/Volumes/Data/Applications -iname "*\.app" -type d -perm -2 | grep -v Xcode.app ); do sudo /bin/chmod -R o-w "$apps" done.

Propiedades

Sistemas operativos: macos-15
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.1.5 Ensure Appropriate Permissions Are Enabled for System Wide Applications

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos