id: os_user_app_installation_prohibit
title: Prohibit User Installation of Software into /Users/
discussion: |
  Users _MUST_ not be allowed to install software into /Users/.

  Allowing regular users to install software, without explicit privileges, presents the risk of untested and potentially malicious software being installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

  [IMPORTANT]
  ====
  Apple has deprecated the use of link:https://github.com/apple/device-management/blob/eb51fb0cb9626cac4717858556912c257a734ce0/mdm/profiles/com.apple.applicationaccess.new.yaml#L67-L70[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.
  ====
check: |
  /usr/bin/osascript -l JavaScript << EOS
  function run() {
    let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
    .objectForKey('familyControlsEnabled'))
    let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
    .objectForKey('pathBlackList').js
    for ( let app in pathlist ) {
        if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){
            return("true")
        }
    }
    return("false")
    }
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-94323-3
  cci:
    - CCI-001812
    - CCI-003980
  800-53r5:
    - CM-11(2)
  800-53r4:
    - CM-11(2)
  srg:
    - SRG-OS-000362-GPOS-00149
  disa_stig:
    - APPL-15-005080
  cmmc:
    - CM.L2-3.4.9
macOS:
  - '15.0'
tags:
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.applicationaccess.new:
    familyControlsEnabled: true
    pathBlackList:
      - /Users/
