Audit Full Disk Access for Applications

FaibleNiveau 2Revue manuellemacos

Description

Starting with macOS 10.14 Mojave, Apple introduced Transparency, Consent, and Control (TCC) to enhance user privacy by requiring apps to get explicit permission before accessing sensitive data or system features. Full Disk Access (FDA) is a privacy category managed by the TCC (Transparency, Consent, and Control) framework. It controls whether applications can access certain protected areas of the file system, such as Mail, Messages, Safari data, and system logs. Only applications from verified developers with a legitimate operational need—such as security monitoring or system management tools—should be granted Full Disk Access. The access and trust-worthiness of applications should be verified on a regular basis.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Graphical Method: Perform the following steps to verify what applications have full disk access: 1. Open System Settings 2. Select Privacy & Security 3. Select Full Disk Access 4. Verify that the applications are set to your organization's requirements Terminal Method: Run the following command to verify that what applications have full disk access enabled: % /usr/bin/sudo /usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"' The output will be what applications have full disk access enabled.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Graphical Method: Perform the following steps to set full disk access for applications that meet your organization's requirements: 1. Open System Settings 2. Select Privacy & Security 3. Select Full Disk Access 4. Set any listed applications to your organization's requirements 5. (Optional) Select the + to add applications to the list, or - to remove them

Propriétés

Systèmes d'exploitation: macos-14
Étiquettes: access-controlloggingmacossonoma
Référence: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.6.2.1 Audit Full Disk Access for Applications