id: os_prevent_priv_execution
title: Prevent Software From Executing at Higher Privilege Levels than Users Executing The Software
discussion: |
  In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations.Some programs and processes are required to operate at a higher privilege level and therefore should be excluded from the organization-defined software list after review.

  The inherent configuration of the macOS does not allow for non-privileged users to be able to execute functions requiring privilege.

  link:https://developer.apple.com/library/archive/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Permissions/Permissions.html[]
check: |
  The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.
fix: |
  The technology inherently meets this requirement. No fix is required.
references:
  cce:
    - CCE-94260-7
  cci:
    - N/A
  800-53r5:
    - AC-6(8)
  800-53r4:
    - AC-6(8)
  disa_stig:
    - N/A
  srg:
    - SRG-OS-000326-GPOS-00126
  800-171r3:
    - 03.01.07
  macOS:
  - '15.0'
tags:
  - inherent
  - cnssi-1253_low
  - cnssi-1253_high
  - srg
  - cnssi-1253_moderate
mobileconfig: false
mobileconfig_info:
