Ensure Media Sharing Is Disabled

低级别 2自动化macos

说明

Starting with macOS 10.15, Apple has provided a control which permits a user to share Apple-downloaded content on all Apple devices that are signed in with the same Apple ID. This allows users to share downloaded movies, music, or TV shows with other controlled macOS, iOS, and iPadOS devices, as well as photos with Apple TVs. With this capability, guest users can also use media downloaded on the computer. The recommended best practice is not to use the computer as a server, but to utilize Apple's cloud storage in order to download and use content stored there if content stored with Apple is used on multiple devices. https://support.apple.com/guide/mac-help/set-up-media-sharing-on-mac- mchlp13371337/mac Disabling Media Sharing reduces the remote attack surface of the system.

检查方式

审计方法: Shell 命令

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharing'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowMediaSharingModification'))
  if ( pref1 == 0 && pref2 == 0 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

预期输出: true

修复方式

修复方法: 操作指南或基础设施补丁

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.preferences.sharing.SharingPrefsExtension 2. The key to include is homeSharingUIStatus 3. The key must be set to <integer>0</integer> 4. The key to also include is legacySharingUIStatus 5. The key must be set to <integer>0</integer> 6. The key to also include is mediaSharingUIStatus 7. The key must be set to <integer>0</integer>

属性

操作系统: macos-14
标签: macossonoma
参考: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.3.3.9 Ensure Media Sharing Is Disabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target macos --level 2