Ensure System Integrity Protection Status (SIP) Is Enabled

高等級 1自動化macos

說明

System Integrity Protection is a security feature introduced in OS X 10.11 El Capitan. System Integrity Protection restricts access to System domain locations and restricts runtime attachment to system processes. Any attempt to inspect or attach to a system process will fail. Kernel Extensions are now restricted to /Library/Extensions and are required to be signed with a Developer ID. Running without System Integrity Protection on a production system runs the risk of the modification of system binaries or code injection of system processes that would otherwise be protected by SIP.

檢查方式

稽核方法: Shell 指令

shell

out=$(/usr/bin/csrutil status 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -q "System Integrity Protection status: enabled" && echo compliant

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Terminal Method: Perform the following steps to enable System Integrity Protection: 1. Reboot into the Recovery Partition (system-reboot and hold down Command (⌘) + R) 2. Select Utilities 3. Select Terminal 4. Run the following command: # /usr/bin/sudo /usr/bin/csrutil enable Successfully enabled System Integrity Protection. Please restart the machine for the changes to take effect. 5. Reboot the computer Note: You should research why the system had SIP disabled. It might be a better option to erase the Mac and reinstall the operating system. That is at your discretion. Note: You cannot enable System Integrity Protection from the booted operating system. If the remediation is attempted in the booted OS and not the Recovery Partition the output will give the error csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

屬性

作業系統: macos-14
標籤: macossonoma
參考資料: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.1.2 Ensure System Integrity Protection Status (SIP) Is Enabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos