U Apple macOS 15 V1R1

ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

All (158)

Highs (11)

Mediums (145)

Lows (2)

UNCLASSIFIED

Group Title

SRG-OS-000033-GPOS-00014

Group ID

V-268438

Rule Version

APPL-15-000054

Rule Title

The macOS system must limit SSHD to FIPS-compliant connections.

Rule ID

SV-268438r1034254_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If SSHD is enabled, it must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS-140 validated.

FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets federal requirements.

Operating systems using encryption must use FIPS-validated mechanisms for authenticating to cryptographic modules.

NOTE: For more information on FIPS compliance with the version of SSHD included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000396-GPOS-00176, SRG-OS-000424-GPOS-00188, SRG-OS-000478-GPOS-00223

Documentable

False

Check Content

Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms [email protected],[email protected],ecdsa-sha2-nistp256,[email protected]" "KexAlgorithms ecdh-sha2-nistp256" "MACs [email protected],hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected],[email protected]" "CASignatureAlgorithms ecdsa-sha2-nistp256,[email protected]")

total=0

for config in $fips_sshd_config; do

total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total)

done

echo $total

If the result is not "7", this is a finding.

Check System

C-72468r1034252_chk

Fix Reference

F-72369r1034253_fix

Fix Text

Configure the macOS system to limit SSHD to FIPS-compliant connections with the following command:

/bin/ln -fs /etc/ssh/crypto/fips.conf /etc/ssh/crypto.conf

Identities

CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-000803

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

800-53 :: IA-7
800-53 Rev. 4 :: IA-7
800-53 Rev. 5 :: IA-7
800-53A :: IA-7.1

CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

800-53 Rev. 4 :: SC-8 (1)
800-53 Rev. 5 :: SC-8 (1)

CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

800-53 Rev. 4 :: SC-13
800-53 Rev. 5 :: SC-13 b

CCI-002890

Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

800-53 Rev. 4 :: MA-4 (6)
800-53 Rev. 5 :: MA-4 (6)

CCI-003123

Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

800-53 Rev. 4 :: MA-4 (6)
800-53 Rev. 5 :: MA-4 (6)

Group Title

SRG-OS-000033-GPOS-00014

Group ID

V-268439

Rule Version

APPL-15-000057

Rule Title

The macOS system must limit SSH to FIPS-compliant connections.

Rule ID

SV-268439r1034803_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

SSH must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS-140 validated.

FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets federal requirements.

Operating systems using encryption must use FIPS-validated mechanisms for authenticating to cryptographic modules.

NOTE: For more information on FIPS compliance with the version of SSH included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000250-GPOS-00093, SRG-OS-000396-GPOS-00176, SRG-OS-000424-GPOS-00188, SRG-OS-000478-GPOS-00223

Documentable

False

Check Content

Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command:

fips_ssh_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms [email protected],[email protected],ecdsa-sha2-nistp256,[email protected]" "KexAlgorithms ecdh-sha2-nistp256" "MACs [email protected],hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected],[email protected]" "CASignatureAlgorithms ecdsa-sha2-nistp256,[email protected]")

total=0

ret="pass"

for config in $fips_ssh_config; do

if [[ "$ret" == "fail" ]]; then

break

for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do

sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . | /usr/bin/grep -ci "$config")

if [[ "$sshCheck" == "0" ]]; then

ret="fail"

break

done

echo $ret

If the result is not "pass", this is a finding.

Check System

C-72469r1034801_chk

Fix Reference

F-72370r1034802_fix

Fix Text

Configure the macOS system to limit SSH to FIPS-compliant connections with the following command:

if [ -f /etc/ssh/crypto.conf ] && /usr/bin/grep -q "Include /etc/ssh/crypto.conf" /etc/ssh/ssh_config.d/100-macos.conf 2>/dev/null; then

/bin/ln -fs /etc/ssh/crypto/fips.conf /etc/ssh/crypto.conf

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*')

for ssh_config in $fips_ssh_config; do

ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1)

/usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf"

for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do

config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1)

configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')

configarray=( ${(f)configfiles} )

if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then

for c in $configarray; do

if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then

continue

/usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c"

if [[ "$c" =~ ".ssh/config" ]]; then

if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then

old_file=$(cat ~$u/.ssh/config)

echo "$ssh_config" > ~$u/.ssh/config

echo "$old_file" >> ~$u/.ssh/config

done

Identities

CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-000803

800-53 :: IA-7
800-53 Rev. 4 :: IA-7
800-53 Rev. 5 :: IA-7
800-53A :: IA-7.1

CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

800-53 Rev. 4 :: SC-8 (1)
800-53 Rev. 5 :: SC-8 (1)

CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

800-53 Rev. 4 :: SC-13
800-53 Rev. 5 :: SC-13 b

Group Title

SRG-OS-000067-GPOS-00035

Group ID

V-268477

Rule Version

APPL-15-001150

Rule Title

The macOS system must disable password authentication for SSH.

Rule ID

SV-268477r1034371_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If remote login through SSH is enabled, password-based authentication must be disabled for user login.

All users must go through multifactor authentication to prevent unauthenticated access and potential compromise to the system.

NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.

Satisfies: SRG-OS-000067-GPOS-00035, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000112-GPOS-00057, SRG-OS-000125-GPOS-00065, SRG-OS-000375-GPOS-00160

Documentable

False

Check Content

Verify the macOS system is configured to disable password authentication for SSH with the following command:

/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)'

If the result is not "2", this is a finding.

Check System

C-72507r1034369_chk

Fix Reference

F-72408r1034370_fix

Fix Text

Configure the macOS system to disable password authentication for SSH with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')

if [[ -z $include_dir ]]; then

/usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config

echo "passwordauthentication no" >> "${include_dir}01-mscp-sshd.conf"

echo "kbdinteractiveauthentication no" >> "${include_dir}01-mscp-sshd.conf"

for file in $(ls ${include_dir}); do

if [[ "$file" == "100-macos.conf" ]]; then

continue

if [[ "$file" == "01-mscp-sshd.conf" ]]; then

break

/bin/mv ${include_dir}${file} ${include_dir}20-${file}

done

Identities

CCI-000186

For public key-based authentication, enforce authorized access to the corresponding private key.

800-53 :: IA-5 (2)
800-53 Rev. 4 :: IA-5 (2) (b)
800-53 Rev. 5 :: IA-5 (2) (a) (1)
800-53A :: IA-5 (2).1

CCI-000765

Implement multifactor authentication for network access to privileged accounts.

800-53 :: IA-2 (1)
800-53 Rev. 4 :: IA-2 (1)
800-53 Rev. 5 :: IA-2 (1)
800-53A :: IA-2 (1).1

CCI-000766

Implement multifactor authentication for network access to non-privileged accounts.

800-53 :: IA-2 (2)
800-53 Rev. 4 :: IA-2 (2)
800-53 Rev. 5 :: IA-2 (2)
800-53A :: IA-2 (2).1

CCI-000877

Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

800-53 :: MA-4 c
800-53 Rev. 4 :: MA-4 c
800-53 Rev. 5 :: MA-4 c
800-53A :: MA-4.1 (iv)

CCI-001941

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

800-53 Rev. 4 :: IA-2 (8)
800-53 Rev. 5 :: IA-2 (8)

CCI-004046

Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

800-53 Rev. 5 :: IA-2 (6) (a)

Group Title

SRG-OS-000074-GPOS-00042

Group ID

V-268499

Rule Version

APPL-15-002038

Rule Title

The macOS system must disable Trivial File Transfer Protocol (TFTP) service.

Rule ID

SV-268499r1034437_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If the system does not require TFTP support, it is nonessential and must be disabled.

The information system must be configured to provide only essential capabilities. Disabling TFTP helps prevent the unauthorized connection of devices and unauthorized transfer of information.

NOTE: TFTP service is disabled at startup by default with macOS.

Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000080-GPOS-00048

Documentable

False

Check Content

Verify the macOS system is configured to disable TFTP service with the following command:

/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.tftpd" => disabled'

If the result is not "1", this is a finding.

Check System

C-72529r1034435_chk

Fix Reference

F-72430r1034436_fix

Fix Text

Configure the macOS system to disable TFTP service with the following command:

/bin/launchctl disable system/com.apple.tftpd

The system may need to be restarted for the update to take effect.

Identities

CCI-000197

For password-based authentication, transmit passwords only cryptographically-protected channels.

800-53 :: IA-5 (1) (c)
800-53 Rev. 4 :: IA-5 (1) (c)
800-53 Rev. 5 :: IA-5 (1) (c)
800-53A :: IA-5 (1).1 (v)

CCI-000213

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53 :: AC-3
800-53 Rev. 4 :: AC-3
800-53 Rev. 5 :: AC-3
800-53A :: AC-3.1

Group Title

SRG-OS-000366-GPOS-00153

Group ID

V-268508

Rule Version

APPL-15-002060

Rule Title

The macOS system must apply gatekeeper settings to block applications from unidentified developers.

Rule ID

SV-268508r1034464_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The information system implements cryptographic mechanisms to authenticate software prior to installation.

Gatekeeper settings must be configured correctly to allow the system to run only applications downloaded from the Mac App Store or applications signed with a valid Apple Developer ID code. Administrator users will still have the option to override these settings on a per-app basis. Gatekeeper is a security feature that ensures that applications must be digitally signed by an Apple-issued certificate to run. Digital signatures allow the macOS to verify that the application has not been modified by a malicious third party.

Documentable

False

Check Content

Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following command:

/usr/sbin/spctl --status --verbose | /usr/bin/grep -c "developer id enabled"

If the result is not "1", this is a finding.

Check System

C-72538r1034462_chk

Fix Reference

F-72439r1034463_fix

Fix Text

Configure the macOS system to apply gatekeeper settings to block applications from unidentified developers with the following command:

/usr/sbin/spctl --global-enable; /usr/sbin/spctl --enable

Identities

CCI-003992

Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

800-53 Rev. 5 :: CM-14

Group Title

SRG-OS-000423-GPOS-00187

Group ID

V-268509

Rule Version

APPL-15-002062

Rule Title

The macOS system must disable Bluetooth when no approved device is connected.

Rule ID

SV-268509r1034467_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The macOS system must be configured to disable Bluetooth unless an approved device is connected.

[IMPORTANT]

====

Information system security officers (ISSOs) may make the risk-based decision not to disable Bluetooth to maintain necessary functionality, but they are advised to first fully weigh the potential risks posed to their organization.

====

Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000481-GPOS-00481

Documentable

False

Check Content

Verify the macOS system is configured to disable Bluetooth with the following command:

/usr/bin/osascript -l JavaScript << EOS

$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\

.objectForKey('DisableBluetooth').js

EOS

If the result is not "true", this is a finding.

Check System

C-72539r1034465_chk

Fix Reference

F-72440r1034466_fix

Fix Text

Configure the macOS system to disable Bluetooth by installing the "com.apple.MCXBluetooth" configuration profile.

Identities

CCI-002418

Protect the confidentiality and/or integrity of transmitted information.

800-53 Rev. 4 :: SC-8
800-53 Rev. 5 :: SC-8

Group Title

SRG-OS-000366-GPOS-00153

Group ID

V-268511

Rule Version

APPL-15-002064

Rule Title

The macOS system must enable gatekeeper.

Rule ID

SV-268511r1034473_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

Gatekeeper must be enabled.

Gatekeeper is a security feature that ensures that applications are digitally signed by an Apple-issued certificate before they are permitted to run. Digital signatures allow the macOS host to verify that the application has not been modified by a malicious third party.

Administrator users will still have the option to override these settings on a case-by-case basis.

Documentable

False

Check Content

Verify the macOS system is configured to enable gatekeeper with the following command:

/usr/sbin/spctl --status | /usr/bin/grep -c "assessments enabled"

If the result is not "1", this is a finding.

Check System

C-72541r1034471_chk

Fix Reference

F-72442r1034472_fix

Fix Text

Configure the macOS system to enable gatekeeper with the following command:

/usr/sbin/spctl --global-enable

Identities

CCI-003992

800-53 Rev. 5 :: CM-14

Group Title

SRG-OS-000104-GPOS-00051

Group ID

V-268512

Rule Version

APPL-15-002066

Rule Title

The macOS system must disable unattended or automatic login to the system.

Rule ID

SV-268512r1034476_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

Automatic login must be disabled.

When automatic logins are enabled, the default user account is automatically logged on at boot time without prompting the user for a password. Even if the screen is later locked, a malicious user would be able to reboot the computer and find it already logged in. Disabling automatic logins mitigates this risk.

Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000480-GPOS-00229

Documentable

False

Check Content

Verify the macOS system is configured to disable unattended or automatic login to the system with the following command:

/usr/bin/osascript -l JavaScript << EOS

$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\

.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js

EOS

If the result is not "true", this is a finding.

Check System

C-72542r1034474_chk

Fix Reference

F-72443r1034475_fix

Fix Text

Configure the macOS system to disable unattended or automatic login to the system by installing the "com.apple.loginwindow" configuration profile.

Identities

CCI-000366

Implement the security configuration settings.

800-53 :: CM-6 b
800-53 Rev. 4 :: CM-6 b
800-53 Rev. 5 :: CM-6 b
800-53A :: CM-6.1 (iv)

CCI-000764

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

800-53 :: IA-2
800-53 Rev. 4 :: IA-2
800-53 Rev. 5 :: IA-2
800-53A :: IA-2.1

Group Title

SRG-OS-000324-GPOS-00125

Group ID

V-268514

Rule Version

APPL-15-002069

Rule Title

The macOS system must require an administrator password to modify systemwide preferences.

Rule ID

SV-268514r1034482_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The system must be configured to require an administrator password to modify the systemwide preferences in System Settings.

Some Preference Panes in System Settings contain settings that affect the entire system. Requiring a password to unlock these systemwide settings reduces the risk of an unauthorized user modifying system configurations.

Documentable

False

Check Content

Verify the macOS system is configured to require administrator privileges to modify systemwide settings with the following command:

authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine")

result="1"

for section in ${authDBs[@]}; do

if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then

result="0"

if [[ $(security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then

result="0"

if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then

result="0"

if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then

result="0"

done

echo $result

If the result is not "1", this is a finding.

Check System

C-72544r1034480_chk

Fix Reference

F-72445r1034481_fix

Fix Text

Configure the macOS system to require administrator privileges to modify systemwide settings with the following command:

for section in ${authDBs[@]}; do

/usr/bin/security -q authorizationdb read "$section" > "/tmp/$section.plist"

class_key_value=$(usr/libexec/PlistBuddy -c "Print :class" "/tmp/$section.plist" 2>&1)

if [[ "$class_key_value" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :class string user" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :class user" "/tmp/$section.plist"

key_value=$(/usr/libexec/PlistBuddy -c "Print :shared" "/tmp/$section.plist" 2>&1)

if [[ "$key_value" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :shared bool false" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :shared false" "/tmp/$section.plist"

auth_user_key=$(/usr/libexec/PlistBuddy -c "Print :authenticate-user" "/tmp/$section.plist" 2>&1)

if [[ "$auth_user_key" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :authenticate-user bool true" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :authenticate-user true" "/tmp/$section.plist"

session_owner_key=$(/usr/libexec/PlistBuddy -c "Print :session-owner" "/tmp/$section.plist" 2>&1)

if [[ "$session_owner_key" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :session-owner bool false" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :session-owner false" "/tmp/$section.plist"

group_key=$(usr/libexec/PlistBuddy -c "Print :group" "/tmp/$section.plist" 2>&1)

if [[ "$group_key" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :group string admin" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :group admin" "/tmp/$section.plist"

/usr/bin/security -q authorizationdb write "$section" < "/tmp/$section.plist"

done

Identities

CCI-002235

Prevent non-privileged users from executing privileged functions.

800-53 Rev. 4 :: AC-6 (10)
800-53 Rev. 5 :: AC-6 (10)

Group Title

SRG-OS-000051-GPOS-00024

Group ID

V-268555

Rule Version

APPL-15-005001

Rule Title

The macOS system must ensure System Integrity Protection is enabled.

Rule ID

SV-268555r1034605_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

System Integrity Protection is vital to protecting the integrity of the system as it prevents malicious users and software from making unauthorized and/or unintended modifications to protected files and folders; ensures the presence of an audit record generation capability for defined auditable events for all operating system components; protects audit tools from unauthorized access, modification, and deletion; restricts the root user account and limits the actions that the root user can perform on protected parts of the macOS; and prevents nonprivileged users from granting other users direct access to the contents of their home directories and folders.

NOTE: System Integrity Protection is enabled by default in macOS.

Satisfies: SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000062-GPOS-00031, SRG-OS-000080-GPOS-00048, SRG-OS-000122-GPOS-00063, SRG-OS-000138-GPOS-00069, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000259-GPOS-00100, SRG-OS-000278-GPOS-00108, SRG-OS-000350-GPOS-00138

Documentable

False

Check Content

Verify the macOS system is configured to enable System Integrity Protection with the following command:

/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.'

If the result is not "1", this is a finding.

Check System

C-72585r1034603_chk

Fix Reference

F-72486r1034604_fix

Fix Text

Configure the macOS system to enable System Integrity Protection by booting into "Recovery" mode, launching "Terminal" from the "Utilities" menu, and running the following command:

/usr/bin/csrutil enable

Identities

CCI-000154

Provide the capability to centrally review and analyze audit records from multiple components within the system.

800-53 :: AU-6 (4)
800-53 Rev. 4 :: AU-6 (4)
800-53 Rev. 5 :: AU-6 (4)
800-53A :: AU-6 (4).1

CCI-000158

Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.

800-53 :: AU-7 (1)
800-53 Rev. 4 :: AU-7 (1)
800-53 Rev. 5 :: AU-7 (1)
800-53A :: AU-7 (1).1

CCI-000162

Protect audit information from unauthorized access.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000163

Protect audit information from unauthorized modification.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000164

Protect audit information from unauthorized deletion.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000169

Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

800-53 :: AU-12 a
800-53 Rev. 4 :: AU-12 a
800-53 Rev. 5 :: AU-12 a
800-53A :: AU-12.1 (ii)

CCI-000213

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53 :: AC-3
800-53 Rev. 4 :: AC-3
800-53 Rev. 5 :: AC-3
800-53A :: AC-3.1

CCI-001090

Prevent unauthorized and unintended information transfer via shared system resources.

800-53 :: SC-4
800-53 Rev. 4 :: SC-4
800-53 Rev. 5 :: SC-4
800-53A :: SC-4.1

CCI-001493

Protect audit tools from unauthorized access.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-001494

Protect audit tools from unauthorized modification.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9
800-53A :: AU-9.1

CCI-001495

Protect audit tools from unauthorized deletion.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9
800-53A :: AU-9.1

CCI-001496

Implement cryptographic mechanisms to protect the integrity of audit tools.

800-53 :: AU-9 (3)
800-53 Rev. 4 :: AU-9 (3)
800-53 Rev. 5 :: AU-9 (3)
800-53A :: AU-9 (3).1

CCI-001499

Limit privileges to change software resident within software libraries.

800-53 :: CM-5 (6)
800-53 Rev. 4 :: CM-5 (6)
800-53 Rev. 5 :: CM-5 (6)
800-53A :: CM-5 (6).1

CCI-001876

Provide an audit reduction capability that supports on-demand reporting requirements.

800-53 Rev. 4 :: AU-7 a
800-53 Rev. 5 :: AU-7 a

CCI-001878

Provide a report generation capability that supports on-demand audit review and analysis.

800-53 Rev. 4 :: AU-7 a
800-53 Rev. 5 :: AU-7 a

Group Title

SRG-OS-000185-GPOS-00079

Group ID

V-268556

Rule Version

APPL-15-005020

Rule Title

The macOS system must enforce FileVault.

Rule ID

SV-268556r1034608_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184

Documentable

False

Check Content

Verify the macOS system is configured to enforce FileVault with the following command:

dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS

$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\

.objectForKey('dontAllowFDEDisable').js

EOS

)

fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.")

if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then

echo "1"

else

echo "0"

If the result is not "1", this is a finding.

Check System

C-72586r1034606_chk

Fix Reference

F-72487r1034607_fix

Fix Text

Refer to the FileVault supplemental to implement this rule.

Identities

CCI-001199

Protects the confidentiality and/or integrity of organization-defined information at rest.

800-53 :: SC-28
800-53 Rev. 4 :: SC-28
800-53 Rev. 5 :: SC-28
800-53A :: SC-28.1

CCI-002475

Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.

800-53 Rev. 4 :: SC-28 (1)
800-53 Rev. 5 :: SC-28 (1)

CCI-002476

Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

800-53 Rev. 4 :: SC-28 (1)
800-53 Rev. 5 :: SC-28 (1)

UNCLASSIFIED