Ensure No World Writable Folders Exist in the Library Folder

CaoCấp 2Tự độngmacos

Mô tả

Software sometimes insists on being installed in the /System/Volumes/Data/Library directory and has inappropriate world-writable permissions. This software could be compromised with the folder(s) being world-writable by unauthorized actions. Folders in /System/Volumes/Data/Library should not be world-writable. The audit check excludes folders where the sticky bit is set by Apple. These folders are required by the operating system to run and should not be modified. Some security vendors use a world-writable folder for their security extension tool. This will be considered compliant due to the tools themselves not allowing a user to write to their folders. This is against the standard practice on POSIX systems. It is considered compliant here because of additional security vendor controls that are controlled through industry standard mitigations.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

[ -d /System/Volumes/Data ] || exit 1
/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/grep -vE "/Library/AppStore" | /usr/bin/wc -l | /usr/bin/xargs

Đầu ra mong đợi: 0

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Terminal Method: Run the following command to set permissions so that folders are not world-writable in the /System/Volumes/Data/Library folder: % /usr/bin/sudo IFS=$'\n' for libPermissions in $(/usr/bin/find /Library -type d -perm -002 ! -perm - 1000 ! -xattrname com.apple.rootless 2>/dev/null); do /bin/chmod -R o-w "$libPermissions" done

Thuộc tính

Hệ điều hành: macos-14
Thẻ: macossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.1.7 Ensure No World Writable Folders Exist in the Library Folder

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos --level 2