Ensure No World Writable Folders Exist in the System Folder

AltaNivel 1Automatizadamacos

Descripción

Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions. Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a persistent presence on the system.

Cómo se verifica

Método de auditoría: Comando de shell

shell

[ -d /System/Volumes/Data/System ] || exit 1
/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: IFS=$'\n' for sysPermissions in $( sudo /usr/bin/find /System/Volumes/Data/System -type d -perm -2 2>/dev/null | /usr/bin/grep -vE "downloadDir|locks" ); do /bin/chmod -R o-w "$sysPermissions" done.

Propiedades

Sistemas operativos: macos-15
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.1.6 Ensure No World Writable Folders Exist in the System Folder

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos