Files
macos_security/rules/os/os_gatekeeper_rearm.yaml
2023-09-14 14:21:06 -04:00

59 lines
1.1 KiB
YAML

id: os_gatekeeper_rearm
title: "Enforce Gatekeeper 30 Day Automatic Rearm"
discussion: |
Gatekeeper _MUST_ be configured to automatically rearm after 30 days if disabled.
check: |
/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security')\
.objectForKey('GKAutoRearm').js
EOS
result:
string: "true"
fix: |
This is implemented by a Configuration Profile.
references:
cce:
- CCE-92796-2
cci:
- N/A
800-53r5:
- CM-5
800-53r4:
- CM-5
- SI-3
srg:
- N/A
disa_stig:
- N/A
800-171r2:
- 3.4.5
cis:
benchmark:
- N/A
controls v8:
- 10.5
cmmc:
- SI.L1-3.14.1
- SI.L1-3.14.2
- SI.L1-3.14.4
- CM.L2-3.4.5
macOS:
- "14.0"
tags:
- 800-53r5_low
- 800-53r5_moderate
- 800-53r5_high
- 800-53r4_moderate
- 800-53r4_high
- 800-171
- cisv8
- cnssi-1253_moderate
- cnssi-1253_low
- cnssi-1253_high
- cmmc_lvl2
- cmmc_lvl1
mobileconfig: true
mobileconfig_info:
com.apple.ManagedClient.preferences:
com.apple.security:
GKAutoRearm: true