Audit Full Disk Access for Applications

低级别 2人工审核macos

说明

Starting with macOS 10.14 Mojave, Apple introduced Transparency, Consent, and Control (TCC) to enhance user privacy by requiring apps to get explicit permission before accessing sensitive data or system features. Full Disk Access (FDA) is a privacy category managed by the TCC (Transparency, Consent, and Control) framework. It controls whether applications can access certain protected areas of the file system, such as Mail, Messages, Safari data, and system logs. Only applications from verified developers with a legitimate operational need—such as security monitoring or system management tools—should be granted Full Disk Access. The access and trust-worthiness of applications should be verified on a regular basis.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Graphical Method: Perform the following steps to verify what applications have full disk access: 1. Open System Settings 2. Select Privacy & Security 3. Select Full Disk Access 4. Verify that the applications are set to your organization's requirements Terminal Method: Run the following command to verify that what applications have full disk access enabled: % /usr/bin/sudo /usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"' The output will be what applications have full disk access enabled.

修复方式

修复方法: 操作指南或基础设施补丁

Graphical Method: Perform the following steps to set full disk access for applications that meet your organization's requirements: 1. Open System Settings 2. Select Privacy & Security 3. Select Full Disk Access 4. Set any listed applications to your organization's requirements 5. (Optional) Select the + to add applications to the list, or - to remove them

属性

操作系统: macos-14
标签: access-controlloggingmacossonoma
参考: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.6.2.1 Audit Full Disk Access for Applications