mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 05:53:24 +00:00
74 lines
1.9 KiB
YAML
74 lines
1.9 KiB
YAML
id: os_facetime_app_disable
|
|
title: "Disable FaceTime.app"
|
|
discussion: |
|
|
The macOS built-in FaceTime.app _MUST_ be disabled.
|
|
|
|
The FaceTime.app establishes a connection to Apple's iCloud service, even when security controls have been put in place to disable iCloud access.
|
|
|
|
[IMPORTANT]
|
|
====
|
|
Apple has deprecated the use of link:https://github.com/apple/device-management/blob/eb51fb0cb9626cac4717858556912c257a734ce0/mdm/profiles/com.apple.applicationaccess.new.yaml#L67-L70[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.
|
|
====
|
|
check: |
|
|
/usr/bin/osascript -l JavaScript << EOS
|
|
function run() {
|
|
let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
|
|
.objectForKey('familyControlsEnabled'))
|
|
let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\
|
|
.objectForKey('pathBlackList').js
|
|
for ( let app in pathlist ) {
|
|
if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){
|
|
return("true")
|
|
}
|
|
}
|
|
return("false")
|
|
}
|
|
EOS
|
|
result:
|
|
string: "true"
|
|
fix: |
|
|
This is implemented by a Configuration Profile.
|
|
references:
|
|
cce:
|
|
- CCE-92788-9
|
|
cci:
|
|
- N/A
|
|
800-53r5:
|
|
- AC-20
|
|
- CM-7
|
|
- CM-7(1)
|
|
800-53r4:
|
|
- CM-7
|
|
- CM-7(1)
|
|
- AC-20
|
|
srg:
|
|
- N/A
|
|
disa_stig:
|
|
- N/A
|
|
800-171r2:
|
|
- 3.1.20
|
|
- 3.4.6
|
|
cis:
|
|
benchmark:
|
|
- N/A
|
|
controls v8:
|
|
- 4.1
|
|
- 4.8
|
|
cmmc:
|
|
- AC.L1-3.1.20
|
|
- CM.L2-3.4.6
|
|
- CM.L2-3.4.7
|
|
macOS:
|
|
- "14.0"
|
|
tags:
|
|
- cnssi-1253_moderate
|
|
- cnssi-1253_low
|
|
- cnssi-1253_high
|
|
severity: "low"
|
|
mobileconfig: true
|
|
mobileconfig_info:
|
|
com.apple.applicationaccess.new:
|
|
familyControlsEnabled: true
|
|
pathBlackList:
|
|
- /Applications/FaceTime.app
|