Files
macos_security/rules/sysprefs/sysprefs_system_wide_preferences_configure.yaml
2022-08-04 11:32:27 -04:00

54 lines
1.5 KiB
YAML

id: system_settings_system_wide_preferences_configure
title: "Require Administrator Password to Modify System-Wide Preferences"
discussion: |
The system _MUST_ be configured to require an administrator password in order to modify the system-wide preferences in System Settings.
Some Preference Panes in System Settings contain settings that affect the entire system. Requiring a password to unlock these system-wide settings reduces the risk of a non-authorized user modifying system configurations.
check: |
/usr/bin/security authorizationdb read system.preferences 2> /dev/null | /usr/bin/grep -A 1 "<key>shared</key>" | /usr/bin/grep -c "<false/>"
result:
integer: 1
fix: |
[source,bash]
----
/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
/usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plist
----
references:
cce:
- N/A
800-53r5:
- AC-6
- AC-6(2)
- AC-6(1)
800-53r4:
- AC-6
- AC-6(1)
- AC-6(2)
disa_stig:
- APPL-12-002069
800-171r2:
- 3.1.5
- 3.1.6
cis:
benchmark:
- 5.10 (level 1)
controls v8:
- 4.1
macOS:
- "13.0"
tags:
- 800-53r5_moderate
- 800-53r5_high
- 800-53r4_moderate
- 800-53r4_high
- 800-171
- cnssi-1253
- cis_lvl1
- cis_lvl2
- cisv8
- stig
severity: "medium"
mobileconfig: false
mobileconfig_info: