usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

fix[rule]: align check with CIS methodology

Browse Source 
update the check to better detect hardware for applicability

issue #576
This commit is contained in:
Dan Brodjieski
2025-10-15 14:15:23 -04:00
parent 9d46e00968
commit 4d29dd4f84
1 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml
View File

@@ -4,15 +4,17 @@ discussion: |
Apple Silicon MacBooks should set sleep timeout to 15 minutes (900 seconds) or less and the display sleep timeout should be 10 minutes (600 seconds) or less but less than the sleep setting.
check: |
error_count=0
if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -q "MacBook"; then
sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}')
displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}')
if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then
((error_count++))
fi
if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then
((error_count++))
if /usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep -q "MacBook"; then
cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string)
if echo "$cpuType" | grep -q "Apple"; then
sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}')
displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}')
if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then
((error_count++))
fi
if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then
((error_count++))
fi
fi
fi
echo "$error_count"