diff --git a/rules/os/os_safari_advertising_privacy_protection_enable.yaml b/rules/os/os_safari_advertising_privacy_protection_enable.yaml index ba1177b6..35fb9f2f 100644 --- a/rules/os/os_safari_advertising_privacy_protection_enable.yaml +++ b/rules/os/os_safari_advertising_privacy_protection_enable.yaml @@ -3,14 +3,11 @@ title: "Ensure Advertising Privacy Protection in Safari Is Enabled" discussion: | Allow privacy-preserving measurement of ad effectiveness _MUST_ be enabled in Safari. check: | - + /usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WebKitPreferences.privateClickMeasurementEnabled = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' result: integer: 1 fix: | - [source,bash] - ---- - - ---- + This is implemented by a Configuration Profile. references: cce: - N/A @@ -35,5 +32,7 @@ tags: - cis_lvl1 - cis_lvl2 - cisv8 -mobileconfig: false -mobileconfig_info: \ No newline at end of file +mobileconfig: true +mobileconfig_info: + com.apple.Safari: + WebKitPreferences.privateClickMeasurementEnabled: true \ No newline at end of file diff --git a/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml b/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml index ae959803..8926b40b 100644 --- a/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml +++ b/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml @@ -1,9 +1,9 @@ -id: os_safari_warn_fraudulent_website_enable -title: "Ensure Warn When Visiting A Fradulent Website in Safari Is Enabled" +id: os_safari_prevent_cross-site_tracking_enable +title: "Ensure Prevent Cross-site Tracking in Safari Is Enabled" discussion: | - Warn when visiting a fraudulent website _MUST_ be enabled in Safari. + Prevent cross-site tracking _MUST_ be enabled in Safari. check: | - /usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' + /usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' result: integer: 1 fix: | @@ -36,4 +36,6 @@ tags: mobileconfig: true mobileconfig_info: com.apple.Safari: - WarnAboutFraudulentWebsites: true + WebKitPreferences.storageBlockingPolicy: 1 + WebKitStorageBlockingPolicy: 1 + BlockStoragePolicy: 2