Ensure Media Sharing Is Disabled

НизкийУровень 2Автоматическаяmacos

Описание

Starting with macOS 10.15, Apple has provided a control which permits a user to share Apple-downloaded content on all Apple devices that are signed in with the same Apple ID. This allows users to share downloaded movies, music, or TV shows with other controlled macOS, iOS, and iPadOS devices, as well as photos with Apple TVs. With this capability, guest users can also use media downloaded on the computer. The recommended best practice is not to use the computer as a server, but to utilize Apple's cloud storage in order to download and use content stored there if content stored with Apple is used on multiple devices. https://support.apple.com/guide/mac-help/set-up-media-sharing-on-mac- mchlp13371337/mac Disabling Media Sharing reduces the remote attack surface of the system.

Как проверяется

Метод проверки: Команда оболочки

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharing'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharingModification'))
  if ( pref1 == 0 && pref2 == 0 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Ожидаемый вывод: true

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.preferences.sharing.SharingPrefsExtension 2. The key to include is homeSharingUIStatus 3. The key must be set to <integer>0</integer> 4. The key to also include is legacySharingUIStatus 5. The key must be set to <integer>0</integer> 6. The key to also include is mediaSharingUIStatus 7. The key must be set to <integer>0</integer>

Свойства

Операционные системы: macos-14
Теги: macossonoma
Источник: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.3.3.9 Ensure Media Sharing Is Disabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target macos --level 2