mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-03-05 01:23:18 +00:00
556 lines
20 KiB
JSON
556 lines
20 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"title": "macOS Security Compliance Project Rule",
|
|
"description": "Schema for a macOS Security Compliance Project rule, detailing security configurations and requirements for Apple platforms.",
|
|
"version": "2.0.0",
|
|
"required": [
|
|
"id",
|
|
"title",
|
|
"discussion",
|
|
"references",
|
|
"platforms"
|
|
],
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"id": {
|
|
"description": "Unique identifier for each rule. The filename for the rule should match this id",
|
|
"type": "string"
|
|
},
|
|
"title": {
|
|
"description": "Title of the rule as it will appear in the documentation",
|
|
"type": "string"
|
|
},
|
|
"discussion": {
|
|
"description": "The discussion may contain a description of the rule, rationale, or other information that will appear in the generated documentation",
|
|
"type": "string"
|
|
},
|
|
"tags": {
|
|
"description": "Metadata keywords used in searching for rules and for cross-referencing.",
|
|
"$ref": "#/$defs/ArrayOfStrings",
|
|
"minItems": 1
|
|
},
|
|
"odv": {
|
|
"description": "Organization Defined Values are determined by a benchmark or customized by the organization.",
|
|
"type": "object",
|
|
"properties": {
|
|
"hint": {
|
|
"type": "object",
|
|
"properties": {
|
|
"datatype": {
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"type": "string"
|
|
},
|
|
"validation": {
|
|
"type": "object",
|
|
"properties": {
|
|
"min": {
|
|
"type": "number"
|
|
},
|
|
"max": {
|
|
"type": "number"
|
|
},
|
|
"regex": {
|
|
"type": "string"
|
|
},
|
|
"enumValues": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": [
|
|
"description",
|
|
"datatype"
|
|
],
|
|
"additionalProperties": false
|
|
},
|
|
"recommended": {
|
|
"$ref": "#/$defs/AnyofStringIntegerBooleanArrayObject"
|
|
}
|
|
},
|
|
"required": [
|
|
"hint",
|
|
"recommended"
|
|
],
|
|
"additionalProperties": true
|
|
},
|
|
"references": {
|
|
"description": "Identifiers used to cross-reference other published security documentation as it relates to MSCP controls",
|
|
"type": "object",
|
|
"properties": {
|
|
"nist": {
|
|
"description": "References to NIST publications and documents",
|
|
"type": "object",
|
|
"properties": {
|
|
"cce": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
},
|
|
"800-53r5": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"pattern": "^[A-Z]{2}-\\d{1,3}(\\(\\d+[a-z]?\\))*$"
|
|
}
|
|
},
|
|
"800-171r3": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"pattern": "^\\d{1,2}\\.\\d{1,2}\\.\\d{1,2}$"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"cce"
|
|
]
|
|
},
|
|
"disa": {
|
|
"type": "object",
|
|
"properties": {
|
|
"cci": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
},
|
|
"srg": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
},
|
|
"disa_stig": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
},
|
|
"cmmc": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
}
|
|
},
|
|
"cis": {
|
|
"type": "object",
|
|
"properties": {
|
|
"benchmark": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
},
|
|
"controls_v8": {
|
|
"type": "array",
|
|
"items": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "number"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"bsi": {
|
|
"type": "object",
|
|
"properties": {
|
|
"indigo": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"nist"
|
|
],
|
|
"additionalProperties": true
|
|
},
|
|
"platforms": {
|
|
"type": "object",
|
|
"properties": {
|
|
"macOS": {
|
|
"type": "object",
|
|
"description": "Schema for identifying components to support macOS",
|
|
"properties": {
|
|
"enforcement_info": {
|
|
"$ref": "#/$defs/enforcement_infoDef"
|
|
},
|
|
"13.0": {
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
"14.0": {
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
"15.0": {
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
"26.0": {
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
"introduced": {
|
|
"type": "string",
|
|
"pattern": "^(\\d+(\\.\\d+){1,2}|-1)$"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"iOS": {
|
|
"type": "object",
|
|
"description": "Schema for identifying components to support iOS",
|
|
"properties": {
|
|
"16.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"17.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"18.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"26.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"introduced": {
|
|
"type": "string"
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"visionOS": {
|
|
"type": "object",
|
|
"description": "Schema for identifying components to support visionOS",
|
|
"properties": {
|
|
"2.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"26.0": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/osDef"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"supervised": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"introduced": {
|
|
"type": "string"
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mobileconfig_info": {
|
|
"$ref": "#/$defs/mobileConfigDef"
|
|
},
|
|
"ddm_info": {
|
|
"$ref": "#/$defs/ddmDef"
|
|
}
|
|
},
|
|
"$defs": {
|
|
"ArrayOfStrings": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"ArrayOfObjects": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"AnyofStringIntegerBooleanArrayObject": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "array",
|
|
"$ref": "#/$defs/ArrayOfStrings"
|
|
},
|
|
{
|
|
"type": "object",
|
|
"additionalProperties": true
|
|
}
|
|
]
|
|
},
|
|
"osDef": {
|
|
"type": "object",
|
|
"description": "Operating System Definition",
|
|
"properties": {
|
|
"benchmarks": {
|
|
"description": "Identifies which benchmarks include this rule.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"severity": {
|
|
"description": "Severity level of the issue, typically defined in a benchmark.",
|
|
"type": "string",
|
|
"enum": [
|
|
"high",
|
|
"medium",
|
|
"low"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mobileconfig_info": {
|
|
"$ref": "#/$defs/mobileConfigDef"
|
|
},
|
|
"enforcement_info": {
|
|
"$ref": "#/$defs/enforcement_infoDef"
|
|
}
|
|
}
|
|
},
|
|
"mobileConfigDef": {
|
|
"type": "array",
|
|
"description": "Definition for supported Mobile Device Management (MDM) configurations",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"PayloadType": {
|
|
"type": "string"
|
|
},
|
|
"PayloadContent": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/AnyofStringIntegerBooleanArrayObject"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"PayloadType",
|
|
"PayloadContent"
|
|
],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"ddmDef": {
|
|
"type": "object",
|
|
"description": "Definition for supported Declarative Device Management (DDM) components",
|
|
"properties": {
|
|
"declarationtype": {
|
|
"type": "string",
|
|
"enum": [
|
|
"com.apple.configuration.services.configuration-files",
|
|
"com.apple.configuration.diskmanagement.settings",
|
|
"com.apple.configuration.passcode.settings"
|
|
]
|
|
},
|
|
"service": {
|
|
"type": "string",
|
|
"enum": [
|
|
"com.apple.sshd",
|
|
"com.apple.sudo",
|
|
"com.apple.pam",
|
|
"com.apple.cups",
|
|
"com.apple.apache.httpd",
|
|
"com.apple.bash",
|
|
"com.apple.zsh"
|
|
]
|
|
},
|
|
"config_file": {
|
|
"type": "string"
|
|
},
|
|
"configuration_key": {
|
|
"type": "string"
|
|
},
|
|
"configuration_value": {
|
|
"$ref": "#/$defs/AnyofStringIntegerBooleanArrayObject"
|
|
},
|
|
"ddm_key": {
|
|
"type": "string"
|
|
},
|
|
"ddm_value": {
|
|
"$ref": "#/$defs/AnyofStringIntegerBooleanArrayObject"
|
|
},
|
|
"if": {
|
|
"properties": {
|
|
"declaration_type": {
|
|
"const": "com.apple.configuration.services.configuration-files"
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"service",
|
|
"config_file",
|
|
"configuration_value",
|
|
"configuration_key"
|
|
]
|
|
},
|
|
"else": {
|
|
"required": [
|
|
"declaration_type",
|
|
"ddm_key",
|
|
"ddm_value"
|
|
]
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"resultDef": {
|
|
"type": "object",
|
|
"description": "Result Definition for return values from shell checks",
|
|
"properties": {
|
|
"string": {
|
|
"type": "string"
|
|
},
|
|
"integer": {
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string",
|
|
"enum": [
|
|
"$ODV"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"boolean": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"enforcement_infoDef": {
|
|
"type": "object",
|
|
"description": "This section contains the check, result, fix, and default state used by the generated compliance script",
|
|
"properties": {
|
|
"check": {
|
|
"type": "object",
|
|
"properties": {
|
|
"shell": {
|
|
"type": "string",
|
|
"description": "Shell command(s) to evaluate the state of a configuration."
|
|
},
|
|
"result": {
|
|
"$ref": "#/$defs/resultDef"
|
|
},
|
|
"additional_info": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"shell",
|
|
"result"
|
|
]
|
|
},
|
|
"fix": {
|
|
"type": "object",
|
|
"properties": {
|
|
"shell": {
|
|
"type": "string",
|
|
"description": "Shell command(s) to fix the configuration if the check command fails."
|
|
},
|
|
"additional_info": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"default_state": {
|
|
"description": "Describes the means to return the system to a default state.",
|
|
"type": "object",
|
|
"properties": {
|
|
"shell": {
|
|
"type": "string",
|
|
"description": "Shell command(s) to restore the system to a default factory state."
|
|
},
|
|
"note": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
} |