mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
54 lines
1.5 KiB
YAML
54 lines
1.5 KiB
YAML
id: system_settings_system_wide_preferences_configure
|
|
title: "Require Administrator Password to Modify System-Wide Preferences"
|
|
discussion: |
|
|
The system _MUST_ be configured to require an administrator password in order to modify the system-wide preferences in System Settings.
|
|
|
|
Some Preference Panes in System Settings contain settings that affect the entire system. Requiring a password to unlock these system-wide settings reduces the risk of a non-authorized user modifying system configurations.
|
|
check: |
|
|
/usr/bin/security authorizationdb read system.preferences 2> /dev/null | /usr/bin/grep -A 1 "<key>shared</key>" | /usr/bin/grep -c "<false/>"
|
|
result:
|
|
integer: 1
|
|
fix: |
|
|
[source,bash]
|
|
----
|
|
/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist
|
|
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
|
|
/usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plist
|
|
----
|
|
references:
|
|
cce:
|
|
- N/A
|
|
800-53r5:
|
|
- AC-6
|
|
- AC-6(2)
|
|
- AC-6(1)
|
|
800-53r4:
|
|
- AC-6
|
|
- AC-6(1)
|
|
- AC-6(2)
|
|
disa_stig:
|
|
- APPL-12-002069
|
|
800-171r2:
|
|
- 3.1.5
|
|
- 3.1.6
|
|
cis:
|
|
benchmark:
|
|
- 5.10 (level 1)
|
|
controls v8:
|
|
- 4.1
|
|
macOS:
|
|
- "13.0"
|
|
tags:
|
|
- 800-53r5_moderate
|
|
- 800-53r5_high
|
|
- 800-53r4_moderate
|
|
- 800-53r4_high
|
|
- 800-171
|
|
- cnssi-1253
|
|
- cis_lvl1
|
|
- cis_lvl2
|
|
- cisv8
|
|
- stig
|
|
severity: "medium"
|
|
mobileconfig: false
|
|
mobileconfig_info: |