id: os_home_folders_secure
title: Secure User's Home Folders
discussion: |
  The system _MUST_ be configured to prevent access to other user's home folders.

  The default behavior of macOS is to allow all valid users access to the top level of every other user's home folder while restricting access only to the Apple default folders within.
check: |
  /usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs
result:
  integer: 0
fix: |
  [source,bash]
  ----
  IFS=$'\n'
  for userDirs in $( /usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" ); do
    /bin/chmod og-rwx "$userDirs"
  done
  unset IFS
  ----
references:
  cce:
    - CCE-95203-6
  cci:
    - CCI-000366
  800-53r5:
    - AC-6
  800-53r4:
    - AC-6
  srg:
    - SRG-OS-000480-GPOS-00230
    - SRG-OS-000480-GPOS-00228
  disa_stig:
    - APPL-26-002068
  800-171r3:
    - 03.01.05
  cis:
    benchmark:
      - 5.1.1 (level 1)
    controls v8:
      - 3.3
  cmmc:
    - AC.L1-3.1.1
    - AC.L1-3.1.2
    - AC.L2-3.1.5
    - AC.L2-3.1.6
  bio:
    - 8.27.01
macOS:
  - '26.0'
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - stig
  - cnssi-1253_moderate
  - nlmapgov_plus
severity: medium
mobileconfig: false
mobileconfig_info:
