os_world_writable_system_folder_configure new restricted folder #117

New Issue

michael · 2026-01-19T18:29:17Z

michael commented

2026-01-19 18:29:17 +00:00

Originally created by @golbiga on GitHub.

Originally assigned to: @golbiga on GitHub.

/System/Volumes/Data/System/Library/AssetsV2/locks/ needs to be added to ignore list for the check:

sudo /usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs

Originally created by @golbiga on GitHub. Originally assigned to: @golbiga on GitHub. `/System/Volumes/Data/System/Library/AssetsV2/locks/` needs to be added to ignore list for the check: `sudo /usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs`

michael closed this issue

2026-01-19 18:29:17 +00:00

michael commented

2026-01-19 18:29:18 +00:00

@ww-adamb commented on GitHub:

@golbiga Would it be better to exclude SIP protected files by filtering on restricted instead of maintaining an ignore list?

/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -exec ls -lOd {} ';' | /usr/bin/grep -v "restricted" | /usr/bin/wc -l | /usr/bin/xargs

@ww-adamb commented on GitHub: @golbiga Would it be better to exclude SIP protected files by filtering on `restricted` instead of maintaining an ignore list? ``` /usr/bin/find /System/Volumes/Data/System -type d -perm -2 -exec ls -lOd {} ';' | /usr/bin/grep -v "restricted" | /usr/bin/wc -l | /usr/bin/xargs ```

michael commented

2026-01-19 18:29:18 +00:00

@golbiga commented on GitHub:

Fixed.

@golbiga commented on GitHub: Fixed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#117