diff --git a/rules/sysprefs/sysprefs_screensaver_ask_for_password_delay_enforce.yaml b/rules/sysprefs/sysprefs_screensaver_ask_for_password_delay_enforce.yaml index 45a83fe5..4233335c 100644 --- a/rules/sysprefs/sysprefs_screensaver_ask_for_password_delay_enforce.yaml +++ b/rules/sysprefs/sysprefs_screensaver_ask_for_password_delay_enforce.yaml @@ -6,11 +6,18 @@ discussion: | An unattended system with an excessive grace period is vulnerable to a malicious user. check: | /usr/bin/osascript -l JavaScript << EOS - $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ - .objectForKey('askForPasswordDelay').js + function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ + .objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } + } EOS result: - integer: 5 + string: "true" fix: | This is implemented by a Configuration Profile. references: diff --git a/rules/sysprefs/sysprefs_screensaver_timeout_enforce.yaml b/rules/sysprefs/sysprefs_screensaver_timeout_enforce.yaml index a7186c0e..55aa51a5 100644 --- a/rules/sysprefs/sysprefs_screensaver_timeout_enforce.yaml +++ b/rules/sysprefs/sysprefs_screensaver_timeout_enforce.yaml @@ -6,11 +6,18 @@ discussion: | This rule ensures that a full session lock is triggered within no more than 20 minutes of inactivity. check: | /usr/bin/osascript -l JavaScript << EOS - $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ - .objectForKey('idleTime').js + function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ + .objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } + } EOS result: - integer: 1200 + string: "true" fix: | This is implemented by a Configuration Profile. references: