Ensure Media Sharing Is Disabled

НискаНиво 2Аутоматскаmacos

Опис

Starting with macOS 10.15, Apple has provided a control which permits a user to share Apple-downloaded content on all Apple devices that are signed in with the same Apple ID. This allows users to share downloaded movies, music, or TV shows with other controlled macOS, iOS, and iPadOS devices, as well as photos with Apple TVs. With this capability, guest users can also use media downloaded on the computer. The recommended best practice is not to use the computer as a server, but to utilize Apple's cloud storage in order to download and use content stored there if content stored with Apple is used on multiple devices. https://support.apple.com/guide/mac-help/set-up-media-sharing-on-mac- mchlp13371337/mac Disabling Media Sharing reduces the remote attack surface of the system.

Како се проверава

Метод провере: Команда љуске

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharing'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharingModification'))
  if ( pref1 == 0 && pref2 == 0 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Очекивани излаз: true

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.preferences.sharing.SharingPrefsExtension 2. The key to include is homeSharingUIStatus 3. The key must be set to <integer>0</integer> 4. The key to also include is legacySharingUIStatus 5. The key must be set to <integer>0</integer> 6. The key to also include is mediaSharingUIStatus 7. The key must be set to <integer>0</integer>

Својства

Оперативни системи: macos-14
Ознаке: macossonoma
Референца: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.3.3.9 Ensure Media Sharing Is Disabled

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target macos --level 2