mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
77 lines
2.2 KiB
YAML
77 lines
2.2 KiB
YAML
id: os_calendar_app_disable
|
|
title: "Disable Calendar.app"
|
|
discussion: |
|
|
The macOS built-in Calendar.app _MUST_ be disabled as this application can establish a connection to non-approved services. This rule is in place to prevent inadvertent data transfers.
|
|
|
|
[IMPORTANT]
|
|
====
|
|
Some organizations allow the use of the built-in Calendar.app for organizational communication. Information System Security Officers (ISSOs) may make the risk-based decision not to disable the macOS built-in Mail.app to avoid losing this functionality, but they are advised to first fully weigh the potential risks posed to their organization.
|
|
====
|
|
|
|
[IMPORTANT]
|
|
====
|
|
Apple has deprecated the use of link:https://github.com/apple/device-management/blob/eb51fb0cb9626cac4717858556912c257a734ce0/mdm/profiles/com.apple.applicationaccess.new.yaml#L67-L70[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.
|
|
====
|
|
check: |
|
|
/usr/bin/osascript -l JavaScript << EOS
|
|
function run() {
|
|
let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
|
|
.objectForKey('familyControlsEnabled'))
|
|
let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
|
|
.objectForKey('pathBlackList').js
|
|
for ( let app in pathlist ) {
|
|
if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){
|
|
return("true")
|
|
}
|
|
}
|
|
return("false")
|
|
}
|
|
EOS
|
|
result:
|
|
string: "true"
|
|
fix: |
|
|
This is implemented by a Configuration Profile.
|
|
references:
|
|
cce:
|
|
- CCE-92771-5
|
|
cci:
|
|
- N/A
|
|
800-53r5:
|
|
- AC-20
|
|
- CM-7
|
|
- CM-7(1)
|
|
800-53r4:
|
|
- CM-7
|
|
- CM-7(1)
|
|
- AC-20
|
|
srg:
|
|
- N/A
|
|
disa_stig:
|
|
- N/A
|
|
800-171r2:
|
|
- 3.1.20
|
|
- 3.4.6
|
|
cis:
|
|
benchmark:
|
|
- N/A
|
|
controls v8:
|
|
- 4.1
|
|
- 4.8
|
|
cmmc:
|
|
- AC.L1-3.1.20
|
|
- CM.L2-3.4.6
|
|
- CM.L2-3.4.7
|
|
macOS:
|
|
- "14.0"
|
|
tags:
|
|
- cnssi-1253_moderate
|
|
- cnssi-1253_low
|
|
- cnssi-1253_high
|
|
severity: "medium"
|
|
mobileconfig: true
|
|
mobileconfig_info:
|
|
com.apple.applicationaccess.new:
|
|
familyControlsEnabled: true
|
|
pathBlackList:
|
|
- /Applications/Calendar.app
|