usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

chore: fix typos and spelling errors

Browse Source
This commit is contained in:
Dan Brodjieski
2025-09-16 10:35:24 -04:00
parent a101ba88b6
commit 466a15423f
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rules/os/os_external_storage_access_defined.yaml
View File

@@ -3,7 +3,7 @@ title: Access to External Storage Must Be Defined
discussion: |-
Access to external storage _MUST_ be managed.
NOTE: Apple's built in method using declative device management method only allows you to set external storage manament to Allowed, ReadOnly, and Disallowed.
NOTE: Apple's built in method using declarative device management method only allows you to set external storage management to Allowed, ReadOnly, and Disallowed.
check: |
/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage'
result:

2
rules/os/os_network_storage_restriction.yaml
View File

@@ -3,7 +3,7 @@ title: Network Storage Must Be Restricted
discussion: |-
Network Storage _MUST_ be restricted.
NOTE: Apple's built in method using declative device management method only allows you to set network storage manament to Allowed, ReadOnly, and Disallowed.
NOTE: Apple's built in method using declarative device management method only allows you to set network storage management to Allowed, ReadOnly, and Disallowed.
check: |
/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.NetworkStorage'
result:

2
rules/os/os_photos_enhanced_search_disable.yaml
View File

@@ -1,7 +1,7 @@
id: os_photos_enhanced_search_disable
title: Disable Photos Enhanced Visual Search
discussion: |-
Enhanced Visualed Search _MUST_ be disabled in the Photos app.
Enhanced Visual Search _MUST_ be disabled in the Photos app.
The information system _MUST_ be configured to provide only essential capabilities. Disabling Enhanced Visual Search will mitigate the risk of unwanted data being sent to Apple.
check: |

2
rules/os/os_safari_clear_history_disable.yaml
View File

@@ -1,7 +1,7 @@
id: os_safari_clear_history_disable
title: Ensure Clearing of Browsing History in Safari Is Disabled
discussion: |
Clearning of browser history _MUST_ be disabled in Safari.
Clearing of browser history _MUST_ be disabled in Safari.
check: |
/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\

2
rules/supplemental/supplemental_firewall_pf.yaml
View File

@@ -13,7 +13,7 @@ discussion: |
* The PF firewall can manipulate virtually any packet data and is highly configurable.
** More information on the BF firewall can be found here: https://www.openbsd.org/faq/pf/index.html
Below is a script that configures ALF and the PF firewall to meet the requirements defined in NIST SP 800-53 (Rev. 5). The script will make sure the application layer firewall is enabled, set logging to "detailed", set built-in signed applications to automatically receive incoming connections, and set downloaded signed applications to automatically receive incoming connections. It will then create a custom rule set and copy `com.apple.pfctl.plis` from `/System/Library/LaunchDaemons/` into the `/Library/LaunchDaemons` folder and name it `800-53.pfctl.plist`. This is done to not conflict with the system's pf ruleset.
Below is a script that configures ALF and the PF firewall to meet the requirements defined in NIST SP 800-53 (Rev. 5). The script will make sure the application layer firewall is enabled, set logging to "detailed", set built-in signed applications to automatically receive incoming connections, and set downloaded signed applications to automatically receive incoming connections. It will then create a custom rule set and copy `com.apple.pfctl.plist` from `/System/Library/LaunchDaemons/` into the `/Library/LaunchDaemons` folder and name it `800-53.pfctl.plist`. This is done to not conflict with the system's pf ruleset.
The custom pf rules are created at `/etc/pf.anchors/800_53_pf_anchors`.