Ensure Signed System Volume (SSV) Is Enabled

高级别 1自动化macos

说明

Signed System Volume is a security feature introduced in macOS 11.0 Big Sur. During system installation, a SHA-256 cryptographic hash is calculated for all immutable system files and stored in a Merkle tree which itself is hashed as the Seal. Both are stored in the metadata of the snapshot created of the System volume. The seal is verified by the boot loader at startup.

检查方式

审计方法: Shell 命令

shell

/usr/bin/csrutil authenticated-root status 2>/dev/null

预期输出: Authenticated Root status: enabled

修复方式

修复方法: 操作指南或基础设施补丁

If SSV has been disabled, assume that the operating system has been compromised. Back up any files, and do a clean install to a known good Operating System.

属性

操作系统: macos-26
标签: macossystem-access
参考: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.1.4 Ensure Signed System Volume (SSV) Is Enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target macos