usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

os_world_writable_library_folder_configure.yaml blocked by SIP? #75

New Issue
Closed
opened 2026-01-19 18:29:08 +00:00 by michael · 8 comments
michael commented 2026-01-19 18:29:08 +00:00
Owner
Copy Link

Originally created by @iamflaurian on GitHub.

os_world_writable_library_folder_configure.yaml blocked by SIP

Steps to reproduce

I tried to set the "Ensure No World Writable Files Exist in the Library" by using the command from JCE with MDM (Script) and via terminal.

IFS=$'\n' for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do /bin/chmod -R o-w "$libPermissions" done

Operating System version

14.7.1 / 15.1 tested it on three different machines

Intel or Apple Silicon

Its just possible for me to test it with Apple Silicon devices

What is the current bug behavior?

For me its seems like its blocked by SIP (System Integrity Protection)

What is the expected correct behavior?

The command should set "0"

Relevant logs and/or screenshots

find: /System/Volumes/Data/Library/Trial: Operation not permitted
find: /System/Volumes/Data/Library/Management/Files/ProtectSudoersFile: Permission denied
find: /System/Volumes/Data/Library/Caches/com.apple.amsengagementd.classicdatavault: Operation not permitted
find: /System/Volumes/Data/Library/Caches/com.apple.aneuserd: Operation not permitted
find: /System/Volumes/Data/Library/Caches/com.apple.iconservices.store: Permission denied
find: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted

Originally created by @iamflaurian on GitHub. **os_world_writable_library_folder_configure.yaml blocked by SIP** ### Steps to reproduce I tried to set the "Ensure No World Writable Files Exist in the Library" by using the command from JCE with MDM (Script) and via terminal. `IFS=$'\n' for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do /bin/chmod -R o-w "$libPermissions" done` ### Operating System version 14.7.1 / 15.1 tested it on three different machines ### Intel or Apple Silicon Its just possible for me to test it with Apple Silicon devices ### What is the current *bug* behavior? For me its seems like its blocked by SIP (System Integrity Protection) ### What is the expected *correct* behavior? The command should set "0" ### Relevant logs and/or screenshots find: /System/Volumes/Data/Library/Trial: Operation not permitted find: /System/Volumes/Data/Library/Management/Files/ProtectSudoersFile: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.amsengagementd.classicdatavault: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.aneuserd: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.iconservices.store: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

@iamflaurian how are you running this command?

@golbiga commented on GitHub: @iamflaurian how are you running this command?
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@iamflaurian commented on GitHub:

Does it mean, CIS has to remove these rule because of SIP block? I'll create an account and also a ticket :) Thanks @golbiga

@iamflaurian commented on GitHub: Does it mean, CIS has to remove these rule because of SIP block? I'll create an account and also a ticket :) Thanks @golbiga
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

@iamflaurian actually we needed to update something on our side, which I will take care of today. We need to add 2>&1 to the find command.

@golbiga commented on GitHub: @iamflaurian actually we needed to update something on our side, which I will take care of today. We need to add `2>&1` to the find command.
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@iamflaurian commented on GitHub:

Hey @golbiga

I add the command in various formats into a script that will be deployed using Jamf Pro. I did not touch it because it worked before updating the macOS versions. Please note, I test it also by using the command in terminal or in other various formats.

NoWorldWriteableFilesExistLibary=$(find /System/Volumes/Data/Library -type d -perm -2 -ls | grep -v Caches | grep -v /Preferences/Audio/Data | wc -l | xargs)

if [ "$NoWorldWriteableFilesExistLibary" != 0 ];
then
	IFS=$'\n'
	for libPermissions in $( find /System/Volumes/Data/Library -type d -perm -2 | grep -v Caches | grep -v /Preferences/Audio/Data );
	do
	chmod -R o-w "$libPermissions"
	printf "Set permissions for 5.1.7 Ensure No World Writable Files Exist in the Library\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
	done
else
	printf "5.1.7 Ensure No World Writable Files Exist in the Library has already the permissions\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
fi
@iamflaurian commented on GitHub: Hey @golbiga I add the command in various formats into a script that will be deployed using Jamf Pro. I did not touch it because it worked before updating the macOS versions. Please note, I test it also by using the command in terminal or in other various formats. ``` NoWorldWriteableFilesExistLibary=$(find /System/Volumes/Data/Library -type d -perm -2 -ls | grep -v Caches | grep -v /Preferences/Audio/Data | wc -l | xargs) if [ "$NoWorldWriteableFilesExistLibary" != 0 ]; then IFS=$'\n' for libPermissions in $( find /System/Volumes/Data/Library -type d -perm -2 | grep -v Caches | grep -v /Preferences/Audio/Data ); do chmod -R o-w "$libPermissions" printf "Set permissions for 5.1.7 Ensure No World Writable Files Exist in the Library\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}" done else printf "5.1.7 Ensure No World Writable Files Exist in the Library has already the permissions\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}" fi ```
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

@iamflaurian so this is a CIS issue, I've let some folks know, but I would recommend opening a ticket with them (create an account on https://workbench.cisecurity.org - if you don't have one)

@golbiga commented on GitHub: @iamflaurian so this is a CIS issue, I've let some folks know, but I would recommend opening a ticket with them (create an account on https://workbench.cisecurity.org - if you don't have one)
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

Forgot to mention this was resolve in 121dc6e44f. Thanks for reporting the issue.

@golbiga commented on GitHub: Forgot to mention this was resolve in https://github.com/usnistgov/macos_security/commit/121dc6e44fee1eca49131958a7de05026f184e77. Thanks for reporting the issue.
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@iamflaurian commented on GitHub:

CIS recommendation:
Audit:

% /usr/bin/sudo 
/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/wc -l | /usr/bin/xargs

Fix:

/usr/bin/sudo IFS=$'\n'
for libPermissions in $(/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null); do
  /bin/chmod -R o-w "$libPermissions"
done
@iamflaurian commented on GitHub: CIS recommendation: Audit: ``` % /usr/bin/sudo /usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/wc -l | /usr/bin/xargs ``` Fix: ``` /usr/bin/sudo IFS=$'\n' for libPermissions in $(/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null); do /bin/chmod -R o-w "$libPermissions" done ```
michael commented 2026-01-19 18:29:09 +00:00
Author
Owner
Copy Link

@iamflaurian commented on GitHub:

Hey @golbiga
first of all, pretty appreciated you for answering my question. I would like add 2>&1 in find command will give the result "11" but does not mean the execution command to set the rule will set $libPermissions. (JFI: Ticket is already open)

@iamflaurian commented on GitHub: Hey @golbiga first of all, pretty appreciated you for answering my question. I would like add 2>&1 in find command will give the result "11" but does not mean the execution command to set the rule will set $libPermissions. (JFI: Ticket is already open)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#75
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?