Rule 7.7 Secure User's Home Folder is not reporting correctly #175

New Issue

michael · 2026-01-19T18:29:30Z

michael commented

2026-01-19 18:29:30 +00:00

Originally created by @Tribruin on GitHub.

Summary

According to the rule 7.7, user folders should be secured to prevent users, other than the owner, from reading the contents of the folder (700)

After running the MCP script audit and remediation, the default permissions (750) remain.

Steps to reproduce

check the permissions of the subfolders of /Users (ls -l /Users) before any rules are applied. Default permissions of all users folders should be (rwxr-x---). Run the check and remediation with this script enabled, and verify the permissions after remediation.

Operating System version

macOS Ventura (13.3.1)

Intel or Apple Silicon

Both

What is the current bug behavior?

The remediation script does not properly check for the correct permissions, even if the permissions are incorrect. And the permissions are not remediated

What is the expected correct behavior?

Permissions on all user folders, except Shared, should be reset to 700

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

Per @brodjieski check for Rule 7.7 should be updated to:
/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d -not -perm 700 | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs

and remediation update to set the correct permissions.

Originally created by @Tribruin on GitHub.  ### Summary According to the rule 7.7, user folders should be secured to prevent users, other than the owner, from reading the contents of the folder (700) After running the MCP script audit and remediation, the default permissions (750) remain. ### Steps to reproduce check the permissions of the subfolders of /Users (ls -l /Users) before any rules are applied. Default permissions of all users folders should be (rwxr-x---). Run the check and remediation with this script enabled, and verify the permissions after remediation. ### Operating System version macOS Ventura (13.3.1) ### Intel or Apple Silicon Both ### What is the current *bug* behavior? The remediation script does not properly check for the correct permissions, even if the permissions are incorrect. And the permissions are not remediated ### What is the expected *correct* behavior? Permissions on all user folders, except Shared, should be reset to 700 ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes Per @brodjieski check for Rule 7.7 should be updated to: ```/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d -not -perm 700 | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs``` and remediation update to set the correct permissions.

michael closed this issue

2026-01-19 18:29:30 +00:00

michael commented

2026-01-19 18:29:31 +00:00

@Tribruin commented on GitHub:

Yes, I just checked and confirmed that user folders are now being set to the expected permissions 700.

Thanks.

@Tribruin commented on GitHub: Yes, I just checked and confirmed that user folders are now being set to the expected permissions 700. Thanks.

michael commented

2026-01-19 18:29:31 +00:00

@brodjieski commented on GitHub:

@Tribruin Let us know if the fix corrects the behavior you were seeing.

Thanks!

@brodjieski commented on GitHub: @Tribruin Let us know if the fix corrects the behavior you were seeing. Thanks!

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#175