id: os_unlock_active_user_session_disable
title: Disable Login to Other User's Active and Locked Sessions
discussion: |
  The ability to log in to another user's active or locked session _MUST_ be disabled.

  macOS has a privilege that can be granted to any user that will allow that user to unlock active user's sessions. Disabling the admins and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
  
  NOTE: Configuring this setting will change the user experience and disable TouchID from unlocking the screensaver. A configuration profile will be generated to include the setting that restores the expected behavior. You can also apply the settings using `/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1`.

  WARNING: This rule may cause issues when platformSSO is configured. 
check: |
  RESULT="FAIL"
  SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver  2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

  if [[ "${SS_RULE}" == "$ODV" ]]; then
      RESULT="PASS"
  else
      PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE"  2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -)
      if /usr/bin/grep -Fxq "$ODV" <<<"$PSSO_CHECK"; then
          RESULT="PASS"
      fi
  fi

  echo $RESULT
result:
  string: "PASS"
fix: |
  [source,bash]
  ----
  SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

  if [[ "$SS_RULE" == *psso* ]]; then
      /usr/bin/security -q authorizationdb read psso-screensaver > "/tmp/psso-screensaver-mscp.plist"
      /usr/bin/sed -i.bak 's/<string>authenticate-session-owner-or-admin<\/string>/<string>$ODV<\/string>/' /tmp/psso-screensaver-mscp.plist
      /usr/bin/security -q authorizationdb write psso-screensaver-mscp < /tmp/psso-screensaver-mscp.plist
      /usr/bin/security -q authorizationdb write system.login.screensaver psso-screensaver-mscp 2>&1
  else
      /usr/bin/security -q authorizationdb write system.login.screensaver "$ODV" 2>&1
  fi
  ----
references:
  cce:
    - CCE-94322-5
  cci:
    - CCI-000764
    - CCI-000770
    - CCI-004045
  800-53r5:
    - IA-2
    - IA-2(5)
  800-53r4:
    - IA-2
    - IA-2(5)
  disa_stig:
    - APPL-15-000090
  srg:
    - SRG-OS-000109-GPOS-00056
    - SRG-OS-000104-GPOS-00051
  800-171r3:
    - 03.05.01
  cis:
    benchmark:
      - 5.7 (level 1)
    controls v8:
      - 4.3
  cmmc:
    - IA.L1-3.5.1
    - IA.L1-3.5.2
  bio:
    - 8.27.01
macOS:
  - '15.0'
odv:
  hint: "Review the /System/Library/Security/authorization.plist file for more information."
  recommended: "authenticate-session-owner"
  cis_lvl1: "authenticate-session-owner"
  cis_lvl2: "authenticate-session-owner"
  stig: "authenticate-session-owner"
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - stig
  - cnssi-1253_moderate
  - nlmapgov_plus
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.loginwindow:
    screenUnlockMode: 1
