From 239fbb874895a68842854d1091ab966a2680dbd8 Mon Sep 17 00:00:00 2001 From: Iris Yuning Ye Date: Mon, 31 Aug 2026 21:18:53 +0100 Subject: [PATCH] Add MSCP CLI pilot package samples --- README.md | 282 +++- docs/baseline-generation-summary.md | 23 + ...cos-custom-compliance-01-create-policy.png | Bin 0 -> 61438 bytes ...mpliance-02-settings-custom-compliance.png | Bin 0 -> 42687 bytes docs/pilot-control-mapping.md | 26 + .../macos-custom-compliance-demo-rules.json | 32 + examples/macos-custom-compliance-demo.sh | 10 + .../800-171_macos_26.0/README.md | 21 + .../800-171_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1115 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 786 ++++++++++ .../part-02-root/manifest.json | 62 + .../part-02-root/rules.json | 760 ++++++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../800-171_macos_26.0/unsupported-rules.json | 200 +++ .../800-53r5_high_macos_26.0/README.md | 21 + .../800-53r5_high_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1103 ++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1067 ++++++++++++++ .../part-02-root/manifest.json | 87 ++ .../part-02-root/rules.json | 1110 +++++++++++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../unsupported-rules.json | 320 +++++ .../800-53r5_low_macos_26.0/README.md | 21 + .../800-53r5_low_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1124 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 666 +++++++++ .../part-02-root/manifest.json | 55 + .../part-02-root/rules.json | 662 +++++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../unsupported-rules.json | 182 +++ .../800-53r5_moderate_macos_26.0/README.md | 21 + .../manifest.json | 28 + .../part-01-root/discovery.sh | 1109 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1031 ++++++++++++++ .../part-02-root/manifest.json | 84 ++ .../part-02-root/rules.json | 1068 ++++++++++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../unsupported-rules.json | 284 ++++ .../all_rules_macos_26.0/README.md | 22 + .../all_rules_macos_26.0/manifest.json | 34 + .../part-01-root/discovery.sh | 1153 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1134 +++++++++++++++ .../part-02-root/manifest.json | 98 ++ .../part-02-root/rules.json | 1264 +++++++++++++++++ .../part-03-root/discovery.sh | 840 +++++++++++ .../part-03-root/manifest.json | 67 + .../part-03-root/rules.json | 830 +++++++++++ .../part-04-user/discovery.sh | 67 + .../part-04-user/manifest.json | 10 + .../part-04-user/rules.json | 32 + .../unsupported-rules.json | 554 ++++++++ .../cis_lvl1_macos_26.0/README.md | 19 + .../cis_lvl1_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1185 ++++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 50 + .../part-02-root/manifest.json | 9 + .../part-02-root/rules.json | 18 + .../part-03-user/discovery.sh | 67 + .../part-03-user/manifest.json | 10 + .../part-03-user/rules.json | 32 + .../unsupported-rules.json | 32 + .../cis_lvl2_macos_26.0/README.md | 19 + .../cis_lvl2_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1152 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 291 ++++ .../part-02-root/manifest.json | 26 + .../part-02-root/rules.json | 256 ++++ .../part-03-user/discovery.sh | 67 + .../part-03-user/manifest.json | 10 + .../part-03-user/rules.json | 32 + .../unsupported-rules.json | 44 + .../cisv8_macos_26.0/README.md | 21 + .../cisv8_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1126 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../cisv8_macos_26.0/part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 913 ++++++++++++ .../part-02-root/manifest.json | 75 + .../cisv8_macos_26.0/part-02-root/rules.json | 942 ++++++++++++ .../part-03-user/discovery.sh | 67 + .../part-03-user/manifest.json | 10 + .../cisv8_macos_26.0/part-03-user/rules.json | 32 + .../cisv8_macos_26.0/unsupported-rules.json | 122 ++ .../cmmc_lvl1_macos_26.0/README.md | 20 + .../cmmc_lvl1_macos_26.0/manifest.json | 22 + .../part-01-root/discovery.sh | 1038 ++++++++++++++ .../part-01-root/manifest.json | 82 ++ .../part-01-root/rules.json | 1040 ++++++++++++++ .../part-02-user/discovery.sh | 50 + .../part-02-user/manifest.json | 9 + .../part-02-user/rules.json | 18 + .../unsupported-rules.json | 80 ++ .../cmmc_lvl2_macos_26.0/README.md | 21 + .../cmmc_lvl2_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1118 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1204 ++++++++++++++++ .../part-02-root/manifest.json | 97 ++ .../part-02-root/rules.json | 1250 ++++++++++++++++ .../part-03-user/discovery.sh | 67 + .../part-03-user/manifest.json | 10 + .../part-03-user/rules.json | 32 + .../unsupported-rules.json | 206 +++ .../cnssi-1253_high_macos_26.0/README.md | 22 + .../cnssi-1253_high_macos_26.0/manifest.json | 34 + .../part-01-root/discovery.sh | 1138 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1177 +++++++++++++++ .../part-02-root/manifest.json | 98 ++ .../part-02-root/rules.json | 1264 +++++++++++++++++ .../part-03-root/discovery.sh | 292 ++++ .../part-03-root/manifest.json | 26 + .../part-03-root/rules.json | 256 ++++ .../part-04-user/discovery.sh | 67 + .../part-04-user/manifest.json | 10 + .../part-04-user/rules.json | 32 + .../unsupported-rules.json | 404 ++++++ .../cnssi-1253_low_macos_26.0/README.md | 22 + .../cnssi-1253_low_macos_26.0/manifest.json | 34 + .../part-01-root/discovery.sh | 1143 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1195 ++++++++++++++++ .../part-02-root/manifest.json | 98 ++ .../part-02-root/rules.json | 1264 +++++++++++++++++ .../part-03-root/discovery.sh | 229 +++ .../part-03-root/manifest.json | 22 + .../part-03-root/rules.json | 200 +++ .../part-04-user/discovery.sh | 67 + .../part-04-user/manifest.json | 10 + .../part-04-user/rules.json | 32 + .../unsupported-rules.json | 314 ++++ .../cnssi-1253_moderate_macos_26.0/README.md | 22 + .../manifest.json | 34 + .../part-01-root/discovery.sh | 1143 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 1182 +++++++++++++++ .../part-02-root/manifest.json | 98 ++ .../part-02-root/rules.json | 1264 +++++++++++++++++ .../part-03-root/discovery.sh | 272 ++++ .../part-03-root/manifest.json | 25 + .../part-03-root/rules.json | 242 ++++ .../part-04-user/discovery.sh | 67 + .../part-04-user/manifest.json | 10 + .../part-04-user/rules.json | 32 + .../unsupported-rules.json | 344 +++++ .../disa_stig_macos_26.0/README.md | 19 + .../disa_stig_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1117 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 829 +++++++++++ .../part-02-root/manifest.json | 66 + .../part-02-root/rules.json | 816 +++++++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../unsupported-rules.json | 68 + .../hicp_lp_macos_26.0/README.md | 21 + .../hicp_lp_macos_26.0/manifest.json | 28 + .../part-01-root/discovery.sh | 1177 +++++++++++++++ .../part-01-root/manifest.json | 98 ++ .../part-01-root/rules.json | 1264 +++++++++++++++++ .../part-02-root/discovery.sh | 496 +++++++ .../part-02-root/manifest.json | 41 + .../part-02-root/rules.json | 466 ++++++ .../part-03-user/discovery.sh | 50 + .../part-03-user/manifest.json | 9 + .../part-03-user/rules.json | 18 + .../hicp_lp_macos_26.0/unsupported-rules.json | 134 ++ .../nlmapgov_base_macos_26.0/README.md | 17 + .../nlmapgov_base_macos_26.0/manifest.json | 16 + .../part-01-root/discovery.sh | 472 ++++++ .../part-01-root/manifest.json | 44 + .../part-01-root/rules.json | 508 +++++++ .../unsupported-rules.json | 20 + .../nlmapgov_plus_macos_26.0/README.md | 17 + .../nlmapgov_plus_macos_26.0/manifest.json | 16 + .../part-01-root/discovery.sh | 1091 ++++++++++++++ .../part-01-root/manifest.json | 90 ++ .../part-01-root/rules.json | 1152 +++++++++++++++ .../unsupported-rules.json | 44 + generated-baselines/summary.json | 104 ++ policies/root-context/discovery.sh | 105 ++ policies/root-context/rules.json | 172 +++ policies/user-context/discovery.sh | 41 + policies/user-context/rules.json | 32 + .../generate_baselines.cpython-312.pyc | Bin 0 -> 20236 bytes scripts/generate_baselines.py | 487 +++++++ 215 files changed, 76066 insertions(+), 35 deletions(-) create mode 100644 docs/baseline-generation-summary.md create mode 100644 docs/images/macos-custom-compliance-01-create-policy.png create mode 100644 docs/images/macos-custom-compliance-02-settings-custom-compliance.png create mode 100644 docs/pilot-control-mapping.md create mode 100644 examples/macos-custom-compliance-demo-rules.json create mode 100644 examples/macos-custom-compliance-demo.sh create mode 100644 generated-baselines/800-171_macos_26.0/README.md create mode 100644 generated-baselines/800-171_macos_26.0/manifest.json create mode 100644 generated-baselines/800-171_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/800-171_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/800-171_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/800-171_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/800-171_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/800-171_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/800-171_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/800-171_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/800-171_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/800-171_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/README.md create mode 100644 generated-baselines/800-53r5_high_macos_26.0/manifest.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/800-53r5_high_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/README.md create mode 100644 generated-baselines/800-53r5_low_macos_26.0/manifest.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/800-53r5_low_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/README.md create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/manifest.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/800-53r5_moderate_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/all_rules_macos_26.0/README.md create mode 100644 generated-baselines/all_rules_macos_26.0/manifest.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/all_rules_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/all_rules_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-03-root/discovery.sh create mode 100644 generated-baselines/all_rules_macos_26.0/part-03-root/manifest.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-03-root/rules.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-04-user/discovery.sh create mode 100644 generated-baselines/all_rules_macos_26.0/part-04-user/manifest.json create mode 100644 generated-baselines/all_rules_macos_26.0/part-04-user/rules.json create mode 100644 generated-baselines/all_rules_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/README.md create mode 100644 generated-baselines/cis_lvl1_macos_26.0/manifest.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/cis_lvl1_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/README.md create mode 100644 generated-baselines/cis_lvl2_macos_26.0/manifest.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/cis_lvl2_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cisv8_macos_26.0/README.md create mode 100644 generated-baselines/cisv8_macos_26.0/manifest.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cisv8_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cisv8_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/cisv8_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/cisv8_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/cisv8_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/README.md create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/manifest.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/discovery.sh create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/manifest.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/rules.json create mode 100644 generated-baselines/cmmc_lvl1_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/README.md create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/manifest.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/cmmc_lvl2_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/README.md create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/manifest.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/rules.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/discovery.sh create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/manifest.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/rules.json create mode 100644 generated-baselines/cnssi-1253_high_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/README.md create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/manifest.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/rules.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/discovery.sh create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/manifest.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/rules.json create mode 100644 generated-baselines/cnssi-1253_low_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/README.md create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/manifest.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/discovery.sh create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/manifest.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/rules.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/discovery.sh create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/manifest.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/rules.json create mode 100644 generated-baselines/cnssi-1253_moderate_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/disa_stig_macos_26.0/README.md create mode 100644 generated-baselines/disa_stig_macos_26.0/manifest.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/disa_stig_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/disa_stig_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/disa_stig_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/disa_stig_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/disa_stig_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/README.md create mode 100644 generated-baselines/hicp_lp_macos_26.0/manifest.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-02-root/discovery.sh create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-02-root/manifest.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-02-root/rules.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-03-user/discovery.sh create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-03-user/manifest.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/part-03-user/rules.json create mode 100644 generated-baselines/hicp_lp_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/README.md create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/manifest.json create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/nlmapgov_base_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/README.md create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/manifest.json create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/discovery.sh create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/manifest.json create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/rules.json create mode 100644 generated-baselines/nlmapgov_plus_macos_26.0/unsupported-rules.json create mode 100644 generated-baselines/summary.json create mode 100644 policies/root-context/discovery.sh create mode 100644 policies/root-context/rules.json create mode 100644 policies/user-context/discovery.sh create mode 100644 policies/user-context/rules.json create mode 100644 scripts/__pycache__/generate_baselines.cpython-312.pyc create mode 100644 scripts/generate_baselines.py diff --git a/README.md b/README.md index d2777faa..3a9c2ba2 100644 --- a/README.md +++ b/README.md @@ -1,49 +1,261 @@ - ____ __ _____ __ ____ _____ _ __ - / _/___ / /___ ______ ___ / ___// /_ ___ / / / / ___/__________(_)___ / /______ - / // __ \/ __/ / / / __ \/ _ \ \__ \/ __ \/ _ \/ / / \__ \/ ___/ ___/ / __ \/ __/ ___/ - _/ // / / / /_/ /_/ / / / / __/ ___/ / / / / __/ / / ___/ / /__/ / / / /_/ / /_(__ ) - /___/_/ /_/\__/\__,_/_/ /_/\___/ /____/_/ /_/\___/_/_/ /____/\___/_/ /_/ .___/\__/____/ - /_/ +# mSCP CLI tool recommendation for Intune custom compliance +This repository is a **tool recommendation and integration guide**. It does not contain or claim to be the mSCP CLI. It recommends using the CLI from the official [NIST macOS Security Compliance Project](https://github.com/usnistgov/macos_security) to generate a macOS security baseline and discovery script for Microsoft Intune custom compliance. -# Intune Customer Experience Engineering Shell Script Repo +The workflow selects an mSCP baseline, uses the recommended CLI to generate the macOS discovery script that detects target identifiers, validates its JSON output, and creates the matching Intune rules JSON. -This repository is for Intune Shell Script Samples. It is maintained by the Microsoft Intune Customer Experience Engineering Team. The samples provided here are for education and showing the art of the possible. You are encouraged to download, test and enhance for your own use. +## Important compatibility note -- ***[Use shell scripts on macOS devices in Intune](https://learn.microsoft.com/mem/intune/apps/macos-shell-scripts)*** -- ***[Use shell scripts on Linux devices in Intune](https://learn.microsoft.com/mem/intune/configuration/custom-settings-linux)*** -- ***[Use custom compliance settings in Linux](https://learn.microsoft.com/mem/intune/protect/compliance-use-custom-settings)*** +The recommended mSCP CLI generates the discovery script. The script detects target identifiers such as `system_settings_firewall_enable` and returns their current values. A separate Intune rules JSON file matches those identifiers and defines which values are compliant: +- It is a zsh audit/remediation script. +- It requires root. +- It writes audit results to local plist, log, and CSV files. +- The script can produce human-readable audit output or JSON discovery output, depending on the source revision. +- Intune requires one valid JSON object whose property names match the rules JSON `SettingName` values. -The Repo is split into scripts for Linux and macOS +This guide assumes that the checked-out mSCP source supports `--json`. Verify `./mscp.py guidance --help` and the generated script before deployment. If the checked-out official source does not provide JSON output, the generated audit script cannot yet be used directly as an Intune discovery script; use a reviewed JSON-output implementation before uploading it. +## Prerequisites + +Run the generation and testing steps on a Mac: + +- macOS supported by the selected mSCP rule set +- Python 3.12 or later +- administrator access for audit testing +- `/bin/zsh` and the macOS utilities used by the selected checks +- `/usr/bin/jq` if your JSON-output integration uses it +- an Intune tenant with permission to create macOS compliance policies + +## Step 1: clone the official mSCP repository + +```bash +git clone https://github.com/usnistgov/macos_security.git +cd macos_security +``` + +Use a tagged release or a reviewed commit for production instead of silently changing source versions. + +## Step 2: create the Python environment + +```bash +python3 -m venv .venv +source .venv/bin/activate +python3 -m pip install --upgrade pip +python3 -m pip install -e . +``` + +Confirm that the CLI starts: + +```bash +./mscp.py --help +``` + +## Step 3: generate a baseline + +Generate a CIS Level 1 baseline: + +```bash +./mscp.py baseline -k cis_lvl1 +``` + +The CLI searches the mSCP rule library for the `cis_lvl1` keyword and writes a YAML baseline similar to: + +```text +custom/baselines/cis_lvl1_macos_26.0.yaml +``` + +The reported rule count is the number of selected rules. It is not a device compliance score. + +You can inspect available baseline keywords before choosing one: + +```bash +./mscp.py baseline --list_tags +``` + +## Step 4: generate the native mSCP compliance script + +Use the baseline YAML as the positional argument and request script generation: + +```bash +./mscp.py guidance \ + custom/baselines/cis_lvl1_macos_26.0.yaml \ + --script \ + --no-docs +``` + +The short form is: + +```bash +./mscp.py guidance -s custom/baselines/cis_lvl1_macos_26.0.yaml +``` + +The generated files are placed under a directory similar to: + +```text +build/cis_lvl1_macos_26.0/ + cis_lvl1_macos_26.0_compliance.sh + preferences/ + org.cis_lvl1_macos_26.0.audit.plist +``` + +The script contains the check and remediation commands derived from the selected mSCP rules. `--no-docs` skips the AsciiDoc, PDF, and HTML guidance documents. + +## Step 5: test the generated script safely + +Run an audit-only check as root: + +```bash +sudo ./build/cis_lvl1_macos_26.0/cis_lvl1_macos_26.0_compliance.sh \ + --check \ + --quiet=2 +``` + +Do not use `--fix` or `--cfc` during Intune discovery testing. Those options can change device settings. + +The native mSCP script records audit state in locations similar to: + +```text +/Library/Preferences/org.cis_lvl1_macos_26.0.audit.plist +/Library/Logs/_cis_lvl1_macos_26.0_baseline.log +/Library/Logs/_cis_lvl1_macos_26.0_baseline.csv +``` + +Review the audit output and confirm that every selected check works on the target macOS version. Investigate empty values, command errors, and checks that report explanatory text instead of a simple value. + +## Step 6: create the Intune rules JSON for the discovery identifiers + +The discovery script returns target identifiers as JSON property names. Create an Intune rules JSON file that matches those identifiers exactly. It must contain a top-level `Rules` array. Each rule must map to a property returned by the discovery script: + +- `SettingName` is case-sensitive and must match the discovered JSON property. +- `DataType` must match the returned type. +- `Operator` defines the comparison. +- `Operand` is the value considered compliant. +- `RemediationStrings` explains how to restore compliance. + +Intune supports these operators: + +```text +IsEquals +NotEquals +GreaterThan +GreaterEquals +LessThan +LessEquals +``` + +Example rule for a JSON property named `system_settings_firewall_enable`: + +```json +{ + "Rules": [ + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "The firewall must be enabled. Value discovered was {ActualValue}.", + "Description": "Enable the macOS firewall or apply the required management configuration." + } + ] + } + ] +} +``` + +The rules JSON matches the discovery identifiers; it does not run the checks. Build it from the reviewed mSCP rule metadata and the exact JSON output of the generated discovery script. Do not map a value such as `"FAIL RUNNING"` to a Boolean rule without explicitly normalizing it first. + +## Step 7: validate discovery identifiers and JSON output + +Intune macOS custom compliance requires the uploaded discovery script to return one valid JSON object. Confirm that the generated discovery script: + +1. Runs the selected mSCP checks in read-only mode. +2. Returns every intended target identifier as a stable JSON property name. +3. Returns booleans, integers, versions, and strings using the types declared in the rules JSON. +4. JSON-escapes multiline and special-character values. +5. Writes diagnostic logs to stderr or a file, never into the JSON response on stdout. +6. Returns a nonzero exit code when the discovery operation itself fails. + +The expected shape is similar to: + +```json +{ + "system_settings_firewall_enable": true, + "audit_folders_mode_configure": 700, + "system_settings_ssh_disable": "FAIL RUNNING" +} ``` - |-Linux - |---Config - |---Custom Compliance - |---Misc - | - |-macOS - |---Apps - |---Config - |---Custom Attributes - |---Custom Profiles - ``` +That object is the device's discovered state. Intune compares it with the `Rules` array; the object is not an overall compliance score. + +Validate the final output on a pilot Mac: + +```bash +sudo ./build/cis_lvl1_macos_26.0/cis_lvl1_macos_26.0_compliance.sh \ + --check \ + --quiet=2 \ + --json | /usr/bin/python3 -m json.tool +``` + +Use the JSON property names from this output as the `SettingName` values in the matching rules JSON. Do not upload a script until the discovery identifiers, output types, and rules JSON have been tested together. + +## Step 8: upload the discovery script to Intune + +1. Open **Intune admin center**. +2. Go to **Devices** -> **macOS** -> **Compliance** -> **Scripts**. +3. Select **Add** and create a macOS custom compliance discovery script. +4. Enter a descriptive name, such as `mSCP CIS Level 1 macOS 26.0`. +5. Upload the tested mSCP-generated JSON discovery script. +6. Set **Run this script using the logged on credentials** to **No** when the integration requires root, as the native mSCP audit script does. +7. Save the script. + +## Step 9: create the Intune compliance policy + +1. Go to **Devices** -> **macOS** -> **Compliance**. +2. Select **Create policy**. +3. Select **macOS** and the Mac compliance policy profile. +4. On **Compliance settings**, enable **Custom Compliance**. +5. Select the discovery script uploaded in Step 8. +6. Upload the rules JSON whose `SettingName` values match the identifiers returned by the discovery script. +7. Configure the noncompliance actions required for the pilot. +8. Assign the policy to a small pilot device group. +9. Review the policy and select **Create**. + +The script and rules JSON are inseparable. Every `SettingName` in the rules JSON must be returned by the script with the declared data type. + +## Step 10: validate device compliance + +1. On a pilot Mac, open **Company Portal**. +2. Select **Devices**, select the Mac, and choose **Check Status**. +3. Wait for the device to check in. +4. In Intune, open **Reports** -> **Device compliance** -> **Noncompliant devices and settings**. +5. Filter for macOS and review each custom setting. + +For troubleshooting, compare: + +```text +mSCP rule metadata + -> generated check + -> JSON discovery property and value + -> Intune rules JSON + -> Intune per-setting result +``` +Custom compliance evaluates and reports device state. It does not remediate the Mac. Use mSCP configuration profiles, DDM, another management policy, or a separately governed remediation process to enforce settings. -### Disclaimer -Understand the impact of each sample script prior to running it; samples should be run in a non-production or "test" environment. +## Updating the baseline -### Contributing -This project welcomes contributions and suggestions. Most contributions require you to agree to a -Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us -the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com. +When updating mSCP: -When you submit a pull request, a CLA bot will automatically determine whether you need to provide -a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions -provided by the bot. You will only need to do this once across all repos using our CLA. +1. Review the selected source commit or release. +2. Regenerate the baseline YAML. +3. Regenerate the compliance script. +4. Re-test every JSON property and data type. +5. Update the Intune rules JSON when rule IDs, expected values, or supported checks change. +6. Pilot the updated script and policy before broad assignment. -This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). -For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or -contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. +Keep the generated baseline, script, rules JSON, source version, and test evidence together so the Intune policy can be reproduced and audited. diff --git a/docs/baseline-generation-summary.md b/docs/baseline-generation-summary.md new file mode 100644 index 00000000..4dd02e32 --- /dev/null +++ b/docs/baseline-generation-summary.md @@ -0,0 +1,23 @@ +# Generated baseline summary + +These assets were generated from the mSCP macOS 26.0 baseline files. + +| Baseline | Supported rules | Unsupported rules | Policy parts | +| --- | ---: | ---: | ---: | +| `800-171_macos_26.0` | 145 | 33 | 3 | +| `800-53r5_high_macos_26.0` | 170 | 53 | 3 | +| `800-53r5_low_macos_26.0` | 138 | 30 | 3 | +| `800-53r5_moderate_macos_26.0` | 167 | 47 | 3 | +| `all_rules_macos_26.0` | 241 | 92 | 4 | +| `cis_lvl1_macos_26.0` | 93 | 5 | 3 | +| `cis_lvl2_macos_26.0` | 110 | 7 | 3 | +| `cisv8_macos_26.0` | 159 | 20 | 3 | +| `cmmc_lvl1_macos_26.0` | 75 | 13 | 2 | +| `cmmc_lvl2_macos_26.0` | 181 | 34 | 3 | +| `cnssi-1253_high_macos_26.0` | 200 | 67 | 4 | +| `cnssi-1253_low_macos_26.0` | 196 | 52 | 4 | +| `cnssi-1253_moderate_macos_26.0` | 199 | 57 | 4 | +| `disa_stig_macos_26.0` | 149 | 11 | 3 | +| `hicp_lp_macos_26.0` | 124 | 22 | 3 | +| `nlmapgov_base_macos_26.0` | 36 | 3 | 1 | +| `nlmapgov_plus_macos_26.0` | 82 | 7 | 1 | diff --git a/docs/images/macos-custom-compliance-01-create-policy.png b/docs/images/macos-custom-compliance-01-create-policy.png new file mode 100644 index 0000000000000000000000000000000000000000..886b957033b2cefcd6556b89e12107c594dd836e GIT binary patch literal 61438 zcmcG$cT|&G7blF@tEiw{5k#&Ok=_-QUKB){iWGs+;*}}9x5XwC0ZSTA@vu3`vzCR!#InOzJ@3YS?zr7F7Z{N~Ce(d*S zEG#U?4GpfDv9KJ%v9KHzKXMrOgmt0K6nHrRGt<{$DaY~60e}4JdiCa27M98cw(UO- z0e>HTU;u)#u$=g?|8tY+g_>k|?W#qf!{QEGh{bF(J)9o2q)R1MQ}>$pD)#nT zbF}Ca^ib-k7v0iL&oMx{(QMdLRu;{5QtEVx4%#Tj^HWe)WbdEe1E_K9^E;O(VLJasK>tn2FZFGUA>V}8cQdG}LN2`5j|f#hnL_== z4Nz-X*7mk*gzo4>5K~rq1BN!?r>&K~u_OO2xlqmLfz_+1vBve%ZT}t+ zZzBVErGYShl%u>zb9q%kB`kvt*=yd9U}TF6hlkyN#l?NP>vNud8P{p9t`8hHAMhjR zd*LgGhFiUJG&a6-VQtrQo0hlvg4`xzR@+#mMHedd^S8fV4Pq1omD9{#fB}M5cl+rx z{RPHV-jfcXja{Y!tix9t(=$=$5H(V_)*Mjg*hkB2|GCSXmMHJtrY~E9gOs{Bc29_> z=6P9J*<7-F&T0^}av|g|709o6Q$nJu3hynGpbTbv=WHvPuX;5uQh%1ZYa_hp_m#XF zm*bV>I#I4{Vr)!;F9l54H5qJ#tf$=AqUkE!+q{7BoGG(>;b7CCe_Fm9%AeDHBY0B? zlvUTg6+BpRy?eOYb#`seT*2q#1ITEnV5mrf_D11C(^7oK{i5iVjSc^F<~FQ+$Dh=! zVuj06cjaE#`q+oNm-+{A28=_baZ$&2B4hbsNXO9%@7BI8!DlU$I>)8j_{(^zA-1A& zFJM&S5Jw|@ZxN><$squ(nkjf!8$~p_8D*f~XTzut3gPIshbbHMVL$ctunBYql4dzg z-$XiitIZ_o5=Jd(&pTVJ2aH?f|2$LUN#!bjONi|XtKVn$(ro4TI>*#x(W{eT7~S2@ zPyDM1c>&nt=H0VqCTYGCrlQj1CSk!ty9S~;H}T0~j#h?QL3W5VDkjIYx(4EY0wh|4 zF}ZoVw4@|S|Md+Y%ED4_&=M%<{`&|^R&$W)w-N6*4Gl)SD!Uwn%6UFmcz|A+<;!C$ z%%vUA`=j8T?HDdDkD6B#0dVF{Ya>x@gHku)8+S_bZ*6Uo7qvshT;ewIrL;<07fR)x z59$zeGi%lU{`t_H@9>2CIC{`y^j!NW!KR(@e(JjF@Moz;2c-mJf5FuDWl1j$N&Yg? zs(0uLo{tGrP0AtQUTbORGI2e3LIeHePZbHdX(clPyRo}eV8+;MX)@krZfC91X>~n& zAc#*aL+%?snI+vq4$pgoeo?7qG+_eMd) zSYY^*i@@nt!Y_>Rn;cjw;c!QEiHi1S(O9T{t;~tNN_8(l$6Q-B??q`akm7culpD;2 zqvA%Ap(SeA;0$^XyAJBrR`#a|?_6S&B<7lbCoz|J}9D6#}P>JBSxP zy5?qH2JU&f6|6dzziT188c1-=-JyZQuxjK-E3E->WbVJL%hHQ0&@i)G#jorAGJE|O zb0iMMxx-5ePpGw=R~-s6^glG>t^dNa)nPA&hUPq@78gUCNc>tM`j8sy<0`Yw+cUvgfHEX@@R5JmhSdl#Wv^Nn&2Oop^guq?}MxN z=IV?nHOpz&OPZJStAkHhj7u#jd88yvWXW^LawI2*0m7NQ1l}6Igzh{|ese1e@rSOr zzh@n6LAEv7u`?c18{j&)D(x-{gEiVH+R45tAvjqrJjrAZsRot&($nDUx~dI=$O`3o zn+w|6fIzq!03UKxGESYJPCUFa1l(BV&C(ZWsM2!A-VC$i|-7(lJkDjE(8Taf)w z>Nr?QVrWV}I?qU4l&Z{t4e!R*?xlNL{xM-;>B5C=Ls-iTQc=Q(X3HL#_4}B0Ti)+f zO6}U{c<1f(%j_cm>R>dd+p(N;;#^!OjuV%K0cH%)?(wD!^KUA)|IH#fvI93)BZCJBCS5)|6REDbWIy{Yz`1dEq7XzsOYXAIbzDk3)E@Po9}SYk&LkFP0T4n zNhyafKPjz{sE&8rskf^g+bSw;oP~ijJ&>hm8mvQXr^)2}dz27f0Y3W3ABr>Bn*{B+6RD)OVX9PRD&;Uuldf19E7)@p+q-1nI1`Z~ zU3#KpqE>=@eBr|lY70%-hn^MC)p2}5lpGhCyEAXS{wP;HAZ+e;`C&yF$T=AeTR+-a%q6JhasPhi7RMJPIOJq- z`3AqLPd<^0%xFV2`2a^p}I*yy!5hR=~C3!Un zHpg6Uz5HUC)4hYuy;2EZP4t+ozk00pP|R3-MAdsK8E}$<-xdA5#cudbhd}S7K~xP} z&sPthxy091H_hHclakSg%O@LTZNoN}jjMvEl_1TYb4OxZw`P$}S0@fjR);0@{~7}b4YsQ0G6I5z`1vgUvw%JhhP6Kj2hEpqbu47LPe!ER3^-QPmGVZ zl$4&hn?fVJ{zQ)rfXeZgJ)$?(-}psd_I>b{RKj6`VO_Z`=Qi3?hHbkcU_;B-zu9#H z-GVQ@S>_CI6CrblYFIjLl*ff{o(#qR8S>yiE|jG1tY#+co^#Y{0Wa-r1}J#-dCw+5 zsHuiI6T)P9R9(F4wna;Fyq%c(^$?lNr{0N=zhydokZm_>eci?Z5B{wdl?Mej9P=H-+Tks{SoqhnFf;Ws&;U${X3u+U8s1l@=StQ~wz<|%X@kFNWXsobr@29R86wK6t5}&gTYlG6K%$+}>iZzR z?v=*vtjzYHdafLaHn4yso^7|}p}Mj)BqK^YaHvs*xToOqXkGs7weGU;xUaZl3uu3X zVfeT3pu3ZfZ>YL5M40RlC$oM3*j;q<$D1P zUt;pR1N`Kf@BDbR|O`Mb4=-&B+0z z`*Y`Q>v%&K3r3mI19a2#=CY!q&!(u7@9n|5x)ErxE&f)4S-?iPd1_8sPuk)0%*AY} zZ!#`=FJ0=g+Zi`k$#>h_x$~$ghEaF!UYA5f%sReA#adj?)Pv@G zlKjM;x>T~d2v(%G|5^~+2>h4)f6+$ z`7^XpyVWBALy}0G()*M=X zDLz9UUDqsjIY0(sOqNUgaOl^bIpX=0f$J;$zu9Ha+F!n7u%{;RdTK21ftB;tmm71+ zJ8X0nd#4t1m{{tHqpDcCq~!3NP4Vmp4okIEH4x?=#xHhf%%QlT_I1Z)hpKANQA?tN zj6b1*X;EBKqT%|!1pT?rYj|p8>Ca$g$`-2S@m=0&F|CnrG)!~e%5u$f{)}H~P?$+{ zo=1zKNh!8&Hs}$kenaN_t>_s8y;@@Bi@G3ta#(s+-A(t$#>hhF+pB`{ALj|Dw(9a3jB!NyD2fd!lhUdpZ48>)~AmH2u<@vVqq#i{9H;?!(O@uf6TSCWt~Xlpv6ohQX7fN7)gRM6LLNXq%5ZGY zM)?aqLeEpCh+#R4=$Si`IaF)WkI}pJ!S+EM?GO3x?g-C*p9e`AFSR_@ z9{o~zItn=E`Zm)c*Xt$ZK_bMG$66JJBk%XDRpkCSPJ>ZrAKDZZ6&8nNMy62U%HFJv4DrP0<@4iHf{+Xe# zl&M&Sv(<;~s4*D$!%?+GtqeG9<<%z`+WW)S`s$CInx0?Z{fRilDI0Am;%_N3>BjSo zzu%@@>udk?hpTbCxCFhe2e|}px}da@y6eWKDX)IY0Rd5xT>B{N|J1Y zq!oCb+sGh__b3~#)S}zam^j~!V9mN=y02Mxj52n^WNjk`IyL=@4$3JKouWMu0;uEaw*3tUy{>=RaH+V#SOIt`-SS z-#OjbVr55#z5Xs52_ zqjH~}3JcS6mt^U(DmnO5J8hAA@5O~GxlLXZfHqPoLOg;D*52SBcHg@wWdxP;xo$KO zYU*_&9!}wx@19a%W*BA3gq;gCp^uV3c81`0jGB6Bjf!}D&@F+C<(ILT1!Xf+(U{&fx~a!%Fz;~@A}6&HmVAl&$htBrCo8T7gk`<*Wbm>ewy{? z-t9qPqmK#}nWFsWFSft?=pT?4w{>PNoQy~NL^Zu#dHJQ}ZJ`gtsZR`a#;(&YRAo-C z(dk6IRjRUPlU!ZrIv>-%pghzeJ9+dC+KX1H(rUOLluLw`!0?U-&y>DtIi#Ra6l?K1eJ@2XZ{9A(5mO6CjU%yy3uTFR8CQ}pM#^v!tUxo0tx zeRg*F)1&_Fk9|H+Y{je&F3V>(rP3#Cf;uxso1QVdQxuen*C41+ulCY4KyGecsm!o| zgzeqkNswTR+Y+b0U&H0hZQ?F9phU>g5G!&c> zGi5f;+<2NpNZZ!k+kSXf4!&m%$;JUB9__vKrq(r0jPD#`QC7N|;FNPQG^00zkvt;@ z2X9bET`A@ZZ%h6KGW`om98Yd}1Rw}{WkD_eeVwcAJnA~5Mn?YK8421|8|j^I)Hqyr zKW7}>8(JFgClFlpLd&$)F8v4i_8$P@|2zH%B*zMHhfRa#*8dGac<8Khn!S8T{sfq& zDgN=lu+Z^jaKctfDf1FIUO>~`zs2BTu=WtM_@7#O+NoaH6{A2>K)1sHZk!Phb)z}L46(8|7n|Nj2r zq?&XeK1W-gLZSGq&KS}xSiZyl3gc9TBu@Zye67P7!O+)w(iL6v%gXvRxLLON{?=B5 z=!3wJO<6N&xe<&TeWPb?;LYsj$~38nP1a8k zxNO4uP^fYBJ#$1Gc}B^Tc0Y8PR~< zv;mj&Z*zoiMue;nS(Q(}+OKXb8_To<(wiMDGPi_I3=TS-*k|)3Am4@z4z0~ABzz7) zrn$LrdU|?Q0M&sA%@XB(ZIa_9E9hu8I;iEF6}%U=mM0jw`bK*Pn^9R{E?Bj`0Nzvc zjor%NnD~W-1$(+@i{$=;GIjshDPY&m{jxv(nP}MFXw1wdYThqOiC`fJDy*i4-Zg<$gQ3lbJ*W#ag*$tXj(_db=aAg#_q7E-Lpur zmuU6v$;xZj*UU#*4P5@ntUbu`FgtDvmH2DFInsTutQ}M3iWdl4#kQ{1ui7;SxVV*5 zt0#%CUcGwO2}~|xUfPb?3XKM~UO;msv^@x3<^e*;PG4t7u$Npr{u=z0{dWx;vDs9k z#-J0yDF*GBmK`7cyb~-}@YkWY3?7@#GH7^h?@-ThmHQgAK?)yjP@~m_6j8mk^ntCF zja88igs^*KXnYWVDA)=qVMsH>%U*mH-1hiTJn?1iDE%bmawh%$k`=gQXWle! zPS2j24PUB^r)5BaGxLeR3E1FJShb4P-jqCMq(Dj8{P34{w|w@#7dEs(ftSq~i&dBy z_Iq2N=o|5gyBwTFD##H#UiB+GqS$lTdmXAQFL{8P$H%C`s`{p;v8{%xDznqFHZy8s zW{5VsDBA@4^P`6<9i&R`S<53RoMUpa6ey)?Y#}hT77ZHgG)lo$yYyXBhF7uqFtZoo zwH1)l!}HMgXl?>=1AaFLqGdH$=`Ja7CstqT0}!~hsi_thdgv55jGlTttD`d`hZ-Y4JBifN{<$1sRk~; zypgUjJT~SjfjeplMF^!%X_y(7=0Hx9i_c^$I2(QEYrbF!E-@QNee;sr z!oB50btzp6*T>7)fLsDs^g-COh+v&Bi*(U`46tt$Y%y5$_424_reegL> zelBulo(e0=$KsY2hp%-{ty(Qmn$kXS zA35@#Fa1*R+YN{HB=+^IAn=VJl39vvCB-4oramA=wz3kbIj&5 zNb*j_=^DrDGS8>ueqqUvmHOz-95N^>QgvFY0@y8*>Eqrv^eCri7K8JLD(oc|A}cUl zF`y&*(m2YrFgG51FLnHLG_3lX^5j9dfBo)6(Pi8alvJtYSGt>BRJlGp+Y1PpWn7dn zwGCLf+$jy!@N=H2W1syGs2Nll_w8hTiXpfSkM#QO=w8z#m=FiNpUj-u`=#jtq7!O! z*y;4sW8c2S&^D>UuSWQI-Lt7(pVB&glD}Xg5k*?4fy)!KK8%NkQ@fokvj}znhs-ax za0@oj39-neS9U$W7g|)Y4v%&iX6wToGBhRX!=HT0Ja~or?M`Azg}314?&{lAFQCYp zuY&!}7+U_t`E9e)a|aeU|0D=nUO3&HdetyBFdD`T4CUor4_<@U#4H)my<4E<2tk!w6_Mp}_M7p`eZ0=c)R9RI==ZAR)OQr#mNoyVW$R{x9TbrkUYN0 zbZ)!z;<{7z+(%eGDHd`Z;NMvoE$eT3_3HgtmcoyH1djVd!7V3f_S{8q^8>T`m+N0- zXW5+ITA7yAC>y)|kv(%GQzRWY2`{hm_RITLEKTQ~CO;q3zeee|Y|&dqI`!lmPCI>k zc{Sdz)iG3iom0I(V^Y0((QoiWg=~mJGG}m%y#-h9DQ_iX?|2UVO&W0!0Dc9b!H!^o+T2maheQTS4KypxQ{}lt%x&oI~d|c(c%!&Em*c zhiTCH?cfey*({~AT6Q(wM`Z^TBwoAi01meUQgj+!CjL@I{Lgsl6D%4=j)HVp{JwCW ztE{%1i$IA?(kWm(tQ$l2^||-1A(L@q>g=cmz!lf z%vz@hDi*DI9XL~91$eIyg6zM~+B{uuSa~#SqtjCtYdy93(hTtYZ^Afym=aWuU)H4t z%^v}=1{ZK3S(bGZq;LfwAN|qx(yisrN<_8d`#0LPlw_0}hO^j07@%t_$|yKQ;!P&3 zqqbV#D{1=%oZ>-We|4G+oz&+Vfe?tt>yqV<;Fp&G;)1-l(sW_(sm+$rV69-oK=`xW zZ!d8insIe10o$|DWY!nKpR`1L?HnBL%kEec3|Lv#_%;wS4h5K-;P;|;emFCLDi-av z(kVN?(ny5rJ2}un>=_Lkg=(ZhSXj&YfwcL9YGtby^4`MSWkM9Q!jy6Mxs>;-E|r!J zZr(|x5i=|vo16>!wn3=$y|HoH&C4n()%e>bvX3-r{k`DJAPjp}t)6>kX2B(KD}NjK zbZf%1wONzHu}Nb-K&`Ox5>oC3G@kyJtsUd%ty)!33(5e-HeImoc-qmM*sIg*>%SY> z`S9d`h?Oj4U`(cOHWH!fe9jV?76n?tsA^GOq>F?W97SWf`Oi1BxYDI^!|5Y^VeyajmQ7d4go8aw5Pf#{7EOPL&ozG z6^@WZ7t8w$#F5XVwv-6bEM6&9wpVuEuBn}@(e8SlP4ts5w30^C52ULq$iBFYt9~8S z^z`eOq+{dNpB*(sm-saOdmP_@oOQn%gmoF80&5F6X3Am{p~ zhOzwZWjRp`SfZ!GulG!VJ6rFjfW|pHvl4K{Nq5V7dJyTdu3Av|2V(z3YZ$LW;F<_% z3e%LZA(Y$Ua}kJ?p8uo9cv;-%@$;!)LLXbA7WT}5C^_dxD7LRnVJ}sp%1n63BUS3c zsh2Y02UwQ>5jATx?8}xHv^@OWf(n*yqX@KG<%pnF!q1V78Pl)i?MIIaefxV7JP;On z_K(@gF_I1kR5_@zu%?Ms)^ z4x~p;tyks(RAcE=O_g(R$5fg>N%hL-)R@Zc(XKBn2;wAa0Q}$-VhJFgW%~;Bge_Pa zCq7&d)NvbYSC!Py$MQ)wL>32G$ebC`*G5OLmIzMD1kCWIeD>x`0p8#9G-nQ8Bn3Um z2SV8&>jSyzW@p{h_Fcb-?Ezgu&>=?atx?H3d5;uRHe20<$*kIekvH*0rEb1iCI$`r zO=imn+f@O_5FR3lGnSs8-BaGxWrXjLZt^Y<3h*+vPVzEFfS=%!*tY@)@q3;wMSi{7 z+iod-@v0|;=FR{UyaQ@2z{{>-y~?DGrSKk|YSk59zrc_AHW%vCQzC2mwDoi#yC#QL zF;H%w=kqI9&CV_^mf}@(iRI$rQmI9zrgnF|5H8cF@#zHH0yFK)ai0(I+^G;N|))4vX|SNTM8(H4V@v?`%B;q)qees0HUE_ z#;n4nH-xc+Ci}tAZTI`}%kc+Twxpu>CABAFf!gcSG@fmZ4Fw<8vK7(}#YiSH+B$D# zm%w&=z7$vndBsD-v!_C~H&=Xyosl43l?Qk4=comAB?>9H^@~8jd%HVjp4F~+e+^=% zB^gc;7U8{0?RRkaGbH8p!ARY^v*q0N^5nFLdaKtz zxZYJiW=8wf`zQ~YV%F&V+$rI#P=vx(Bvsh)A-jO4q0cdhW1wvF^8o0CLz?J8xmLTa zIBT8U6D;4?C2)YwY$x4@?shyqSmm=I6hulAV|;5m%=p}No$)PZpBFsN8d1OuFW?D#S8|gJZRTaIEaLK)X+F*LND^p*Qxca+6NS93mJz&kKQSdXY@^x9C^n$q zcz^4*wEmXzD3xc?(2DhXA_|R07#)IsJsJ3)tC*x|k11956j;4~j>^?G(&}N z>g9#dF*b||)JU4(kSa;V!xTW!}{- zZJ0#zS+Iu4Fa*NSyQve{+TG2+%S{f$saQoe1_?e9QN-5ft>llLlxe0qG@A%Wmm*qE z3(os=lxhAZ^;uiW`?5Td{ymaDnvGrj1dKui~qvX2C9ZKnZoSY9hyvACKR5H}$*U8f-yM zn@)RPpkjr;GtBQ9M>EjFFzobX4}4&U^=BErrt!#QBNn>L5OBk}KNf<{*D9foq%2FF zB3h+IU3-(#Y58rm);!fI{zzF#*2O^7%%TUIz?dAGG2pazm#M3w=(POZL$W47y~fbZ zt2Xv*ZpG(Nj1&7Ap>$*aXtJacyo`(F)cp(yQt@(VX3>I7Vpbcj@e=&@{idtK7egM9 zQ)RGkJAcoT&dm;eQ#+1|o8VqK{Uf=xR~I&}O=I43ZUt|#=DDyZo=jIY`+k{i($umJ zixW*(c)xqDKQTx;$)FT!j1x>^60?IAjw`h2fFwDE!AOv~kO!=w%Njr#BHj2hI}Dj}D{UHR{o zB=NlSl_s(&3Wmqx)jHZ~V^Ulq`--{80IV)H6qmY-vXdxB~FzYB0o&jO3ye!XvPgL z(yEZLd_#n4@a@7i{;W|MwDEO=)~^jKNn&wHx&Ee<6$rmvAuPi9dm+L;OWCl)&3W}U z@jMNBnw(1=THgG|w5%Aazqr#f2%#uTEDOvnOmb{&u_Y-DBQC21%HHWsfHj>aS5)|y zN=QAxYfjLn9ZCcgM8ep;GwfM@I<(IWh?-m#C z9xmY>nAgh4EWm`s$Y8sZMF}gB3X;BdF0q2CMMz4A-}>rs7{_7PZiH-KZaVQ|OtnhI z@m;-ZrJd@O^Vmy3#fYPrOZJ;$IxPLI4Z52#vYS>4#hY*k<^WiLyvOh%~(X%z1dz~UwiLkY#CT| zlHTiNU%$By7?=@%Bb+rw{^(+r-!=ci0u8$cYgFdW1DVD5O2X2s=jAsLO1N2%MY?xl zy%pwYs|jyy?I%kR)J)K}S}i#a)+zvJ zppKALDD1l-*HmhQp2yyHOpgph@M{KJbnJbj`z%^-et0|?MCJ!o&14mJ0uXP+K0f?T zyM>FaenP41C6c4-xIBL%6+bE;&}1%@vsCUk6JG}?8*88TIdEzKkO@7>*F{JMfZwWU zb4map+;mpEmWe62#M8Z3ZXlW#Tbf03z~XCSX4s(=FQUtHSJGMapD3 z+y}3g6Xbz>B7eb9tXjq7$z(gm>KlZoXrlT#nsZb_y9d^JICbYievZ=@L0lo&#MVsM z=cwC)(?-2G;5K4qE;7T-;hrr{$4^YU<|BqhaZ_X2D|`d2D77!tt23>?9$A*c3MUV3 zI5euzx166@+}9r|r^yh7$Bgq=dY%0g4tKo-0A)oW7k)A|#@9)Lnm~7)pH}vo&iHx* zp6om5r{e1F!!t=YT!4P6N>0eFtj06Hm%IU7!r!?**hac3MwnD)r*%gfXf;=zfP!X?w^sdz5Q5@#FH_uNC;Ohem8jC%fI@ z-X^lRQ8s79oeYjtLrg*c;-(&Zt6&&6Ia_h*=EmY$?jsJ4IMkR*c<2F^P~cv}e&GER z&&A5%`U0?3j~V8_Ppo@ehvsM}=mOqGbC}8Ot<(yB z0$*vk^)3I3A%&rQX2WLsIS+YbWaZ+H^uw&S*2Ig%5LT8ex<8|UpXjDS3~XH^`w~QO zcUUn77AnaNyY8Dg<2o<+%kRa~&e$VN)ByzO3+VaSX}f9lv^LOG5a6L_;s>YL5f?WvuT;{i4i?*+EV{KmdQ8+DOx;># z=T-B{n3 zgEsq1f`8lg3y?KD_06HF{1gfr#<&eM{I2WJ(A0y1(J(iTo#1+K%vNKX9Ts<7uvt+$ zaIxO5=yLeU{G0xy*p$U1NLH47AeY_GXMRHRNg&i7dh@njQ7!QpwXHoU@bKI8TtxM` z)%7Or+n2i6NBxa9j+A|kPYjEAgE5AQrg8-EU9j|V%sM(zFlBd?t8@#3KXbw0@NqNV z-yCwrWuErHoSy6;5AN4OUfYQy=VZxzqiEp0W#Mx$#5B zZI_8pQ|wsIHJkoO{G#@geDU<&sWH0`P1S2pFXK{bvy4Sx*PgCbZ_txsPl6B?uV?&y znm24NH-#P%2rn{A@DB>j-%aiZqOXp_X#AZ=*;iM77|Fk+t^XRR<3t>O zf=o1Rr|u_bqw7M+S>Ju20-q-Aq%gw(zizU&1zY+g#MDOyK9fco7i+<8{ zRK!!Xq1)0WUQLy4$Y&Gojd`$6y@PS)q8&m~c#SHw!1T_TY2Y}_lF$1;ZKwEqa+&m;k;l!>(On_R1em6<_IOm3wF4i1zoVH_+hZV5lV)KBc*=`@*S zCbRE$a#g5*06s{Qg(Y9}e_E!5ypqpY!+f&lB5Sg@V=$~N4{QF+1pcxCv}?Cf^b1^M zk^l=!zrepO*Yl|+jyx4*ItxqU#($XGAEeIx=`(*&6V@nlUeKy$KV_Ox4qD>aj=k)? zXyj0tCUo4&@{e#)QW~@E<6KW__nKXwR)ZVe`BFrCK z_xEB))Sb zk#p)hL`AZu>Kd)6Fz#w&{PiSkzwscL<)^d&%%Egd-6ngyS}DTrM-Xa@GK>3q094>*)KAZBqSKCX z2-B`t1>eeENKAlqmyyG_w@(d+Hx1d~+O@pyyj4*)_J`T2-??)~!Dq$*vsl%`XL_hQ z$U_6rFHOlXb@;beO_(=^0wcGDTCp&mDSK?a$%(GVS;u|m$Mk4E05{)-er`DcM3f^Z z@sx@4vaTk^eML$^zRc^`vN37zMR{oQ%nFdTwlmT$I_AH8d9J3crpDs%3BI)3Z8xB| zf`L1a|Au_*QYNH~rMvUDW}piZT7r`fcT=V*JaSJqMk`%W_|a=Qf zlJErdlk7>sknOj@t$d!^(&hnNpms)2fqE$gfS=BDlchFFp?^$V`eA-#B`Zm+jg~)m}Tv&PZa_jDTMK0WGlv3rOIZv#ij}liL#Wd%#{z3zR zOg!gFG!3p?UZvnnQ)B3UoBsq$nREk>;;k%~(9yJ3kJ0ssr|-1o)-S^#XwowXTp7{hbfG zKr)kkwH!GJIN%N|;&Y&xFOli=FFIK$rQ87C~Uyzv03{mA$?U z`Yg6@!CCjF-k_70ohN_e;ybJUU?9k0ES^#&gjr@Y?|+CzrpGjtCwR%Eiz1ppHwVk+qn{S!C^tFJvRSxw&nZ%)8GR*tqUz$* zbXvkBa#SnCcDHKI9Mt3*HAct!1i|n;t6#V75cUs(1JGn)Q^sA6UncaptfQ?Mr94Af z+~h5rnR$(!gI9(yE~eDW<-uO%(DF%S^J~nG8qnGs3K*t;ud5wSPI-`eEim?vR@HL; z#t;Hh>$9;(h2z?kUCNLH+0PPHQbD=6&N&{hHYs2w|CzEns$~*)sz{}-q9neW>b<+o zD0eiN1S~nr*FW7mV0w6##)Z!s1&AlVuhJ}s9yNReeEqL2R233g`PU~u0;3&cwyh6{OFD1&@53QvMpVC;f4IVq%)SuRJnsPNqle! zU_4RdpMqtu7t{;=H5Ww2>DZ-w`<6cUh(d~8KWb)CXYjN!ejwGWa;nMYt6I!2(byt)-p8~%<1rYHub22skZ#)AKBl0 z#x@^(x*g;tPn#P1;lw%rH7ih^2DYpj@IgS}{Ay$*z6Vkvm$(QrIoU5x8KdnmJ z$avLj-;zQHnuF`3L&qj8uGnGOu3>BSVMA{oia9tlgIu| z$5O0RJL?HPiGqTHa!QdL&}bv_Jo?S;F>9z%hg?Zgj$CPK8(Yb2ThsL-)i9g}`*-LR zLrdS+<+IV2B};x?wizl%Bgo8B1}qi>JN@G#hKS}ooqwJ#7-n3k;_cy{SW&EvZ0K+& zYH8itHgljQFxPz|Dmn`N%-4HtQyqk>7Nq$G)t{J36&$c|uc*tG5~+v>Cj zE%BHblcIKJFpobIyz3jPEMin6#-xj7tRm}o3aK$@6?qAXM8Hq>I3w*zX&3>w#@`{m zX%{U)6}6LaYBNCzuF=?Ql`x;NrRA67u2FH3LfHzv-oT0wFtm_~oMObB-`l!}L1_hG z$3#aV_^z%xNN=B)<)hGw_3FFMx0LS;bCI8|FvogIL5jd_>498wvBd4shMo~LWadky zBY`+SQbJqp)osZ77enqOB!ksvzrj4w>H5y@2XDZjD_SKWm=g^;yK75+KFh%Maay19 zbiCAPAGGgF0Y)l0ikfbu_Gk)>K;pDO6}GF7E!_IAz#@xk%nX0~Xkm*yFwa z`w)@D*ia>DCaxL3x+lpMK*&jn(ssY39JT!&Ed@(Ty5nGyI`(w=br}ZpO7o^bH0zvhgz-Us0$7;_mT3>4{s42LLW-Ki8h7!td2xd6a7E2LY2- z@lbfp!f1OVQ48VlL%^@+2N3IqGmssX)Tt1lCL2=Hd$jMm^05uo5g9*Ec66wZm)F;( zPyV4Oczed67Z2H%?7Qa?uy&?0BuD?%u}4MbImzMz;Tn>&4|(onw9+<43B=<3!0ipfsC}h2;iigw_v=SE_ktw~$i3eW_cuwACb{x+JdP zs*kw7ROvycP9vY<$GUFR@`;6dY@4O#?ZO2`?7;$z)-A6>6=FH%A`@sql$j)dE;KvG z+x`$abu-gxxQbp@F?1u~&WNC@&qoaz=YOoges8-Wajkx8yQh17wL6tLJ5Z%;$J{o^ ze?KhK>L`h$d^gT3oL(PZ2yW`Aa($jjo@>Vt7gr1-8+cPa4e=sU1RZF9=grlb2A9s- zcs8Wd@_YA%2wlgM8Jguh-`&OP9hDlSx|(AsPsgypwV_?L`nJZj0NJ5?Tol!B&z zC&sHbj@`B**B zB(h0zLxUO+gKINplIqPYElB{;4h9RK*{Hw?3zg*J4!v>5Y(a5Y{j9O4BHII+7I3V5 zWHz9rQpSDy^?u>!^QE`9i;L{HGy`s*5SV+LowHakaaQ`4A!UU|%7uP%Nzu=c^g@zG zTJ9_2`W(?f*WvdyfWUP{CFj-rPf-!Y6+4@lm`Ex7Byd}M0mA%nwQ=F!Crs0m_|)$jO#JA5=e7zT(NTl-wK`$5`nH#U%sRp5Mp^{^ijPO zF2OPfPl0~QKN^VRlL;i+C)?@;*YnjG(VFBxFiVuWw>at6`-H5>FA!&qDY@>z{jI|3 z!4;CfA`sfFwTVcX<<{pdm2TtHnWd{5&^8X%hB%puY(wMO0da+1cphyb zu{&M5V;OW}?a+%B{7LQV`*GsxlhTOru!?SU)*9-gd*6G_RkY-{SSjezBoh?bE2%2C z4HhvyuHbHjDZQwC(6FBw4fCw6vrkjcj*6j194dJaIKPcU9Y<3p+jysgRhOb2iq8Ty zRe+*?O`tP5dbTIOp|~GyqL(sXnM#uSDWGVblXDNLu)Q=r2#}6a8PCTLxs931SvgT& zRJa0&Uz7z!TO>fcQNKm2#LiNn`6cz5odoW4b1)cM&O^x3RK^cQdnY`$<0ezN1NW|u zL0gROE5Y*@_W$*R2rsbg>KMJCYU-t9qg3C}hP5$lznOFE?!O|9%h>?rvHg+sc+tMv zq-A&JKoI@=A;<=RwQGERe924o++^2?IBZ@L-w3n~n@5$*9%F*Fdy7-0VA@mtbuln9 za2R4~28V*)DB_S_$q^2t_C4?RZx)KASGr`&+e&e>a#-Vs*w+I8my2)Oqbf3KXL(`B zRMoTgookWFvRP-sJe`f5-`k&>?Ngvb!$icG(lg#UGRVuWznBQ~kPmbkbTR8B3j80$eP>itS>LZ^9LKRR zg93t-QBaT;5$Vm2ii)E20HZV^v=AvF1ni7dktPs=RHY@-2`!>RfIv_LA`ps%5L$>3 z5=tm{2c74c=Y8+H?z-!KxF4M5TH`r6XYYM>`L%xu$G|+<%tN|+CqVT@#+I`xBCoxA zTHqlR>fN|nmsgKBu2WHyPCJgS)L!TlQ>7T}oZC;;4mkX7m%m_bmV@xxI4s-B<~e7! z$&E90Q!gk2C8W&de{J=w%bNDChjXHif6h{H&|+F!Gj%m*wZo_OW$WRG2o}lubvI{* zWIA@u?JPlF%v+&{TQw~x?4KG+?58Ur9Z=5o1aUhj(W2Q8=_9q5 z2ZI;2j^A=iCe@E->qWrucbQzha^mTF!-Z!jQu_4}^Ut8^BJ@H;%mX!SrUurLehNO5 zj=c*h?v=YSvPeE)Dm_FsxL&1=PofzO%0oi^YU4&$p6%1;9zeW!v}BJ7`;|R>Tm@Nh zsPOuX{VN(A8%{VIv6_*cQGB!=d@0Wc0lFs`o_;Hf@PeB+)qQtNL|hNmxeJVp99x<1 z&zUqrv&qjcO=h^CUp|XOOq5a%Lw|kHQKX%uSKR96*_)KS4IG|)kMVdP3m5)8B(`)v zGt}kO@F#<-i!WX;h$>PZ;;;0xYe}xoX;jocx-cZIH`Vfp<*1Z~7HRl(8^-*Ix})1} zgI~{=-YLH{{n1xE?(j#~6!IO~5q8)1iYrLHW47A*IC!D`U)xmS z0f@JH*hMRk@9Xeiq2TO?|Wi$vH;V?OI2@3+XjF0N5HTf#~>mN6@@6W>K;Up_-W`T->(8g2P2^?SzDEM(&g*mN@Bc!Y&3 z(CW`%6Id7#Tr1-j=Snrlesf(E?V)ZHs)tbX!D7ci40YOvj`^#Rz$7%h2vr+~3)xRx zZevu2z3Aw6)jE(u06nR%+@Z ztt&!OZb3#wi3!`w-Mtbq7;gY4_`sHZoy+Oz}K`%-Hi zUQIy`jsUgo>I~b2X^>1hKo<{P+80%$Z3)9zHtP{rhyh^8~VjcNVl+JV|&gu{lv>~Wx6nQPEH$ZjY%a}KN``=>aQu= zBf^qCTpMmbZw&1Dm?_<>b*{h1Aad0Qh&LnDVAOKuztVi%zPQ1?L^=L#z18R4*s7)m zO}zVd(c4=&KJXcuH1R6g9WQh%$|`dEC94Hg=GoK+nU527^Cz(Ehm@=;i?%u4+iHVL zAzbVP+Y#DGSfwpm&yD~em1+`CtB~>o!v-Bdp5IYW32|> zl{PTb05OxXLS~v;1n1=MQnQk!_oAJf2(A}rMA-Z&Lplvf{5^v63p0iKm;Qmlw5vHI z?@vjUI-CD~pl)%hOxtoByi54RWrxHMcEYGgR-Dg8dv6h@(q85E1WK!W!Hcx%*}+t{ zIat8B4zlcp*QKbZCZI1Clyjv(UvSqJkJD*kBeXG_&x1#O0iUdGq~JZEXElRD5P4r; zf?*}tiyipKN7%GCG@SEo+NX4vy%tF|b^wqKURBbi`-R#RV$3i#J=!se!yW;3F9K*L zhhUhRj@^ZDX-QIwo1vOJ!7CS0bQ~F!M*2m zNG|FfT;>i?cgktggY!aak%ff#$kOp>C5iuXW9^&QU6~M-5&QZ^WySZTY7(!bIQ$YU7nzwu7zyf_ zUihp?;vO$B|UhxW$SZ!^!U`*v5ytqY=5#l#(Y+4|~w}k1ZfTcJiVCA-DZ=%Czho5ruYe3CF#pwt}AaCW-w z&`-Ncqevxbz*?O@7IuD1`DC5r+eq_GzTvA6&6PdB`*qiocsmwL(nLIebgO}Z_7%>`cP zq`y~{EbDyQD@rmyAbmrMD_Em80G%Hs7*Lt?!lt0xkYy{ur^>rDs!0dsq`psI{{dS? za56j36WnuaB-zTQh53F_=Pu}eU-ABVH-MjL><(k(A}QQ9HZ-`|{JC-KGG4;Y@rWLs z6q5wpvNaWZpXYyH1Uf6X{LRG*M7T>8K?L8XQv~1TQv~<(g!y!9Rgv;5C6(0|?FX+Z zRo2-vzIdaHq#t(31mgQNayQhyAQuVh-|L+5n(1DH^e7Y%N-7&O)_=k8LS3$uL%Gzt zPVc_@VY)ri`TaqX+GErtqlw82<4uv)g9kTLUj*GeW$4nj|EPk34{ORDsC-R#Zn`U9 zdgm}&Y2(l>&`|(xFLb?U^TfiaW%RDJN~#~UVMdnPYHBBk2Ym>Z7y#Vpt^@#AN6uco=PN;|H{@Mb5W zXw1d9Bi4>`x=Pq=%N5N~Sb-BdsLBNCd?07%N9uoeGGN0Dg9oK278aA{isbz-5#=Am z#DpGAXXPQJQ0xQF8LP{)4%7GmDVRJspl7!F)V%B=`_z2lDRy@wI97F|J)|-+vQCn^ zkm{I+=Z>U3v!YkB>!1e<_F$jYK9r}2tjw5*jQMO@-v8g)fCN!Z@OJi$^ERlsQV%*s zoZG2NEiS0E4CD2a9Ma0KOdd#ulKN(C=roK9&gD^o?|^D4OPm?aKk=&$)wYF?e_32^xLQ4nc`Jryk+Y9&Et;$J`MwP zdF|qB?R5U9kR_gMqc1lry+)diE5+hY?w8n?I2}p@& z1xNNJ+d5hTD!@VKvM4oK?;f_}zoEJ@6&9`CaS@}FEswD=)XPVo8!@KiuQ+ToJa)IC z4;{TKM6@1}xMAwr2r`At=NUJEleK17C2?jll0%sRz|P&nA^fjX-DUw}&%3Y$CxfOq zX>&}0FTYi(?DB7=ld35%*)dtoSIe}w2dVwH?wC4|;mn^q)K+&KThx;U$ zF2y)X#C${gK4x~oZ2wDYe$MjfVV%2|3Q3bUk{)zyjo~5itcUh2@kZo8=B=4bnqudB zMwNNW6eD2ZkhLUC>?%C^gv-D1z8^3>p%u5ae6H?jdaH&I`p_!t@=Eq+=1#*wx&%3r zI;W8T)B5m3AxV?6ag&PIb2bSq9)OW>w?%1_1j2N9-;6mXl{6)D+8yxUg|n%OL?u(` z^I!EmlWNmZ9z?a=k=hGK^0%O_2cBO%+kFbA{-KDe3A2v-*5*Spgeg0w`_-cS3AaTi z8{XN9Fe$~EpYZCZ!h!Gu9@79r(ZZ_NzMb=v=1)4!s(hv1l5+fnpThi(??@Dq5t92G z4EZr#0u8;Qj7J}2>k+gv_3GjU9MZ?{RZNV^;F!dFe4tAA=?kXOLpPVu-xd!a_1?>* z!|4PPPo`EF2FJDYDt01B9G^UB<(<=2$NZ;vM($N4K2&ew`qIup3ZulwW4B#m`LuY^ zh^u0omkkC>E=)q1dCUg7WFvA|yH44`1MP{yr|soxY`NIe)pholgV`~;#l@d4fgC9j z^Kfc+_eD?7qOPv43x0m(8rNR~Z!@4doY{kQW@cu$*YKIfzpg}lP%0dH#k%HTOLR~V zbpX~3feagwP$yD;e2sC4z%!LO+tz`#Qd;WYQ%&Il7%985(c1`FbahS$%QovGq^XCG zT}_|rGAvr;Da4#9tu}CDDrF>(#Nu9weQl~3E+07TzbFxnx=x*2-kMTx$E?O#)YkC8 zq9li7g8lUxOrIndq55==PsWKdS3-7e+I06_MLI9N=BBJCijPNCf)2AX|_T`@m&s>A`znj#7g$Ybl*t(ehrVl29?#q362Ra5#~< zEQ8U%7(lvf;}Lj zPKpVfVe6|emmu>a&X=(t1sb7ya7XlGbzrkZX(u@uM*cOf8et zV7B9r>%T*AgpT*fXqO$n3IbPzB*)esUL6*a<5lQd>o-_i*fImxP8~i*HyDv%_Mp!$ zz9KeE?MXj&>dBO&p1tLt`U?Q(@RR-PW-Z{KKjdkF&u3^Vndp7o2-c+Y^q?=?Yo-1~ zAG=hN-!_$;?wPf2`1yr_H&pgp(iW`cPk;jyAbv-$1}wG1^hRL|g=N0$se0`L@W0IB zQThRtx5>k5h<+@KzVbdnXKyn%Od4@?Uq`2YGY08I`8h^2(fV6h1!4V-YdRa+*|;i! z!MCH1>;v6Z3kcg8<)(JuUXH`CP6$yHKr_-LB=+I;K)p4QOo`8Gdk6Q+-o;s0r7r9S z>Kb(cdy1LySsOXLG-T=(hhHteR?mBNXu@b}C*f|3z91UA&bmX9Qr@z)N$w~72u;Jp z7J{cArEo9qv^cavK8?_<_BXJ6>IG!vjsy4`>B?Y82Wf5G*2%Vd>cz^RA%tMhPF3TO z75B%={b-uLfPb#L3GOMoujlu01XY=(O3@Aw`4;=4kx+hdpcKxwZ$yp{W)iQ0gn*ij z9lczC;RDen@~bcgBwe#cI$iaSnh=;lPeQtFBLK@AI3}!6EW*5xmvx{vWC7T|)~LT} z38}eUqTW;Yf)4g4hW~J2;#DXj^wL`xnK#moa4#tdMk!449l7v@%po?nS2LpA`Oh|# zQ1BPGY!vv3IuSufZIJl_etp40TIPtmC%NQVL3}{XcS}gspiJfBAYo}U)RGnT1f;Rry{0ME7p-!QdxASH9BlB znX}N^H#$ZYs&0~#8`#i&WB?ZQe@7ZRbSNemkSHyd#(EgWsI01^&9BQOUTAT zddb<9tg}>-^L{l@Ze?XQrf)PF<9K{ID$C-Qbl@%{EfOm_QpRX7oR9{N?f-c__|;XP zuxagJ)p%AP^*&Q-?#rYm0euUm?Jeo2uSF`qVQzj{);KzztXk6+OQS)l#gFEDz&!-L z{e!GyiZEjmT6=O4B{{|KgJ^w$6b^hYpFUSWwRIkyGS-)AhqGRf1OqzP?Ao>8`Ydd0 z6t`~Q<5ZzNq5eZ;G+0_H>zz?+dCd)telu)mU3)i6a$Xx(c{bEwath>MRYwatwpz)c zM0>sVEA$U;gK>=h%2&AfntQ~q&~`nbdII~Uzm-@6s-L?(<^h=uVxN4`K)V*r>DuMb zy)$#epeP#aBG;(Gt8fn$&>z{z+qj-D=_lftqlUGVv1VU)ZV}Ug_Mkhp0@2^ zZK4K6vG;n3Vlbo+CdlFJW7a}A8br%)&Wl0r!K)e*)J~qxpb(W`K$Kwv=8DBNMmcmB zn}0=*0S&qEKrMt{r$&kn^adTW?3*H_)zT_L@O`ZtgtWIsT(B5bjmvHNnQEv$xvnFS zIjqOTB(^S3B1$rrF&_GN4M*rz&PBeTO|Hz*kx>*9*ue{wa-d24ci?V^1ioI|oXLZ` z@6t%D|0zPTq1|^Nx_%`>8ufEE+RiT$sd{i$F1ZbeXXds2BAgZz-aEn52wP8D=JmeX z)G1`dpUAKjWt#IG1JmtZ=aYQI`8kEZCKTQu(d`WSs`qPcIOn8JQ4(XS2p`32C}uJ5 zk9?^&syP;5C^V2|_tvYE= z5i$<>S-;5-`kqsdVZ#=wL$&f?4ww)&$KtK(FXtE3uE}(}eCMtJ@4Fr*?hFVrlx}-v zdS2oIhda+sK{W5ga5I?S6@q{x{nWF+a-qMpk;Mvvdr_1vpWb|(s^(g|SJ?Y`i*l2m ziHBgrYuRjGsVvMkthsQ+9{G5e!)RUQ)D~)*m6O-@--KG#|1jWk(^n&s&PHPi3JJy? zErVlwdI!2x4@XTTrR{bt3bqbyY8CT)Xj>3XPHc57A!M3|3sqdW zW&LoJU3g-M@~F`gld2w*)?c^N0qqdEtxyqR;G%`11ocE~EEuC_)Cz1M#j>KzXl;j> zf_cp*1O(wI+7;`7y3<5h8+>g4kfhzDAuGZhTyS0q%AY#BlC&9&mCnQY`VLrr{Y?wW zyB?M~gg$AQ8?KWc&avXWa^5|+O5o0UcTigv((ya>e@-uWLFyMA1F4f+PqM@ryfz;` zLA+*@7U>gJ+tLA51R`dPl^Et$6_4dooW6nR%I7!{=6k2WN5VA%Nm}@bl}Ro;+7o*&!Rk)zX;wvwv{-x0n(A`H-L(Jki0$dT_$QX+OJQ3JoUU z=ZXJ~#!Ilb#jJ<8)j=0Lq7ov9v({+(gVC$^G0SF0?M<@2I9H=1b+*!!n^>M>yY3=% zL^;co5|cK|bH{j^oWUJWHCpzW9F-=kUA;dNJe#@0xBI8kMvKyR`R0*x?=fI>JI) zk>Qm%d2VkPC-becKWzP{9Z~LSudv%)iu;*Ur32kd87ygLKI%GOfp-61y$yErUpUCx zbY)uIvkG;xY|erx(?2%9XHK&cDbl`dh@YcMaaLaUuVUfSG`1ZW12uZd@EHY4or}Nm zQJmduAX`_Q$Ps4_G9PzXQX`nsV42T8Go8%ruk?y#kOz};p9E3W(sHPx%mwAVgpl6u zPWHs)uww$9fYd)Y5$_b9voD6R|J9#xdsicO)Xj?q8O=evlIZt4^`KBa*XZrx>~GpV zh?-|YBFq`imYOh~q{yQwzlBIEPpzge?V0yN7wd2RNT}zP4h7ED7MwUzSEDUdB!p{^ zj6PA*tLn-{r{MrVJXGF9APgvkWQj7yIKx(7`FC;YGj^B*jB<_h%8f{$T~wQq1{PMm zt^Fseww6o1-c0dM5U9(1++%Nf)cP=+kyo`Y{1C`rf{YWGNSVS&R4yS6bY%>Z`7D@| zcWLQWa>CqaOW0_KjApZz>(5vR!_rQ_jTaP*#KaFrpfCE*5vcw(Z~UeAX8$@fT=6y% zQAG1k7y>|sd2_0aWPZX@G-C6YWgFzre`um7T-V2wcjDf?_^GoX0^z7x8V(r1OM}B^ zM+)XJCTJ@Lq0Y$cC@hK7^WZ#l75hNur+#;1Ql; zoQ_A#QiKnnbCG|#i56gbT762j1KO7@a{S*&f>pV%o)UowP{TEqMrUYm*I%;7rrk+g z+PTo8Rq{aQSFE`rRasvy)f9Rx=BH<;pRP}*$K^kF7w3B9trYP%Yf-L3&6wwO-yVJa zi&x7W?j|(KVFt}H3k~2T-kC)&zG>3Aw?Abb%n}!BH|T*Q8&|L*Z2NP<7dhs0N>lY{!ju;F zSb+8kFPglAL#LBh^zbv~Ro0cB)osTu5_?{dNO}8i5~B z=JIj5fILxfwzOoZkpsZ(*nHlpOPBaONYD?hO;h>K!b9!X^Q=E zv$ry8QfcSlu5d9XQ1y#4CkYjW5eBKyc4ca%tJhtX&FZQU?I*yg3+oV)&f;xzEh0L% zKeA;0#5R_BRqAW6r%CUF$&%^6)Nb{E}1x+V7 zR;}`R)oUkBz=!+W^GHcrC3Sfd>yJS+V z?lpff_Y-#E>^H z0@C&x9(fZV=^yDgpinvz1)K4B9skO^?tI9S*<%ZggRHnvu*9vVr7&M+OCTrQxk{E6OG~Aw^sy>jn$&pmi5|628fng`8O$-Y&~3VUq-SA+-;Qu#K~{S&3{qMXfZ6P*CNo!Ma%AT~7PtKU}Ffj0bT z3kJ3f@ZTylB892ic>N$smVPw$3z+VAus{#{+3TxQ=!%p9>MjwcT8FkNCF~(Mtj%u& zd@jgX{g^fa>7Z@NSu#vUj$@jix+D{Q(u2<=jNjODZdqfeP|Mg}duQ9}d12dj?HDWj zRQ2X$_@2PY){eDasqKZrD=!GLx8Wguiv3}%J6ZvYnM+;UEa5ckw%fhQ6eEQbSm65e zrU3y&Xas_jG6=&MLnxd8FSQ|e&mh<3AR{nS=$(3u$x{fu!Sa4bb=cLb4H`t8sk1#Z0^+ zr=6BX_#?`8PqP-52GNN%TzD%lQZx&pKEGO==GrumMj4)wLm9{!FK8+@hwf1tvoRf@i zUETuLa)9pq@Q2)eg^PEMA3MpWCZwZZA=CdJL&dKp`W zjSem1-2JCv84#O|4p@zr0dP59Y`r6-qv!h$Z9|zKa;Zu?)W@xWMi_swa)kMstL=QQ zAh;^)@H{Q#X1}yGysH@fj&E#7|NXfaV2!(|t?HYKCnAjaqz?OM16O9|w9~$OkkcPU za2$xA+@0qS7#ERR$hOW5UgAfDo{WcgtPw=WsB$6o?|X=m)i0^rsx=tbRkF zh&s{&IBWbWx=w%Va8&y0yw61EVI?t$eVOmqciVJA*J=g1^18aZqaYE{cdSiZ$8Rzo zqYXc8V{4mJUq2`*$YToG#}s1ZzwRBqPjc;%PF%5TV3FVVcUQO??)b;so<;tgEg!=B z`~$}mR;7q}+;scZpuUpv#$&+MTZnB5;%}L=GqZ;T7Q*8`!zYibsQ9sDv$eoPyO$yU z47=EC`tRhX^{)}T=dzGd86?!8Tm0eFR4DjK)ZiYYN}2ZA+RT4@6xSdiI;M8WjdydD9!m-%Fg9-t4y~CiXnIh(iF)~Jm^RL-A z)IW7=CJ3;ta64SVJG3BKDReD(Vu(mAH%(vzPhtj#%jvQjE8lU^AB;8)4GrsUDJken zzg&#@0gL=Fx&r2B2#vF-Ux0cJ!>^{T1YJ*4R`uFtP`N;~rYR8ZZ+aV4X7N(#$VSz6 z)}dN~1JN{LAjlfW8}NC*yC+N6UWJ{R#PDzN0%@wVkM0KiW^v-{uLSqgu>=CYTjlvz z%d5}gX%{~|`iA;*fOO0n>M9NJ^WnekD-oQv4#^VV_GyVJ_~?Q1xhB`$okokatCZZI z#b?iZ2HN@%b+F>*_XEFWd)-3PPACxqWQ7kdf@Wh|Ok?d0%3$$Y@$|9D7 z0IZ06PJ>CFu9j^nLG%5W+NA=lLKVW#vT7XX@y?vF_A#6SKnKqyFqe6MCVL&OwNoJ- z4~`8f(N(=>mdc+L-MzEJo#-6<1yy+1?m>T=qj=#K8vo1N^6;`=j?H!8Wyt?f(V^Aq zu_`UeOj#&ml~$Nq?W@hLvkOgsK)tKnEv!$WW80{>q0b*OzwrS;+xhPgVx8|G)H-CU zBxJA_7?M*9y~gY_B)+^FqEBoEmO|4Qpudl{_btG8Zx8KbROuQQ!9bulSaaIa7WK^ zLS5)!lg&~??XT3?vB01Y?|Kzx+fcDL?qr7OlXO;_W@4ZC!6FUaT2+exgk z@?S3cKlkkKDLOt`;cyY8fZefmbj+e1pH8ws^>GziD!Z$d^7egy*E-P`-7h6gp6Hg_s6S%=noKGHw3= z1yukowJ85}WW~FL*BXirPUkLa#jxWxL!{%GT3y-|1th`&_t9msJ=GPd^v2XXCWYTg zT9bfl;XXG~L&Hi($PtP2#s{im*wC<0}dJE?_#Xp(6Y>U3R zJV{QuqqcJnSULa=1e}=>1=&3dsG-y~pzfl|6lrU*4aP>G#9XQY(i1!s`fo2dFknwi zpyy;{jwY-x-pS(z4siGk0ype*2g|rzg}$^J&05D?0Y`;^-U`puU8{}lzEef-oj>Px zv;msz8qf+Bzj*vcwQ5MYGOdw7(il;AXm_|=*s}@g3fLnk9`$)}FG3WFQKv|eKA2+; zER4eSfn&P=hcL+pj-9-Qi5tYuWVdoM--|UC9LpP{;E%OR#I<| z#DFvmGX;BM%&3+JtluY)!a?M4Uo7N`4ZG;zhVXC1cms!1c)KmJT+epG8}bGKZYzV5QU)nNmJ8k_cxf(r%3dfSujfCaO$ zCk**BMI#9fr=`;UwAtPxj}+7?TMv|@Fn^r0v&nDNeG3EzUtF1hhXsWZz$Eh4Xk%-5 z(ri5RcQ9*pZu!3OekYICx4ERJmW~2@vCOascBx3bGyhb>b^ah1_6ADoSy-_N*E;g6pA zfXDwkzYqj`)n?aPW9>gHQi<1;*4f6F7_b|>X1j>!7Q2WT>ut-3^s-hrHV5jjsM_)1Z|t14bW73&sbY~&mBhf zogM~j%k36a?EwMtByJQ^3q#cc_0=?ab61)luEIqAuv1C`)+$NGH?c34Ws0}LU$4C-f zy?FcKijRF3eb$&G;r!u%3J!kgTtc;DQ{=3(zg8n5K!I}OzgWp-Vi8tr&i>}mrN*fl z_#qG#j7vOl{ajUe%F{t&XebE|ES-W)5G*|iV-yWubTR`E2a4HoFB<&b26(*+@W{-^LnZ=S)`G~I4p`+=m@<@Vy6 z_e0iK7i{_5sXR_y$nL+4{@JF01#MA^Y4+>rX%4^^_!*?Ae>7h=nrQ06~O-_{s>vx ztuFC`8vBaf87WtyDyQCDSBcV&iUeV;)EgZj2Hik7^mG3T{?&p>@9dtV27|wI=wd1? zUoPh1*fsE+-+uqGdsn1PNeGecyk%m^uI4R9?S;FHD22XlCoI8o)z)5UTS?K#m9E>Q zxzK2PEC876J^g_Jh~z)Lg#ZdNNR#SaKz2YQcDEM=LtW22*=Yadyo_y3dLtox)kd~X z?8DH!X1?~&K;J!ujfI>UR|Sm(gE(7ZE;lN27lchp5>xzKcRQ(ix#X~agA_=|=wLnX zHFO053(B^r#4bTGtxAcvBDEUsh)~WLT$-q_Q3%W#K z{afvGeY=)-2!APvN+=WOo-}=PG1m#IR7sRlaJC6&w(j-zPO@72b@x5n4L_H7T+SET z?^%2MOBp;Fs1nr~7;-))=yumCEkp;M#0DL)bqPom7iz|b@^M`+9OpNE?|MN2GwYht zb6!C?*Vjxel2^jO0wupwLXMc-sMy@jZD)Z@wJg2cqNEQ}tB_3>d_VWU9$DcmBT5Kg zG5fm9TMG0_o!viy+HT9C32x_z@#ktBVviQYG*iYR<``dhMw8?Xqy6#{6&jZkzFPP7 zaIQ^ADra%cYAz&<`&)aa{qbIk;Ws)$v-8zU4|54GfZb`VL`gC=-Yt+K5%Z$JvZi2O z)+?@1c{R}1pVSqi7r`0mSh2#@xZ$QXg|_~-Zu}P{%Yu`*43eG&we>m&`MfY z?Pa+t^4WI%pHY}+1LPxQJEKMW#Z`iqt!CLcsjT^l>rAX|5%G^-Bsn$C#rxhDndv(g z>YLNtXO4Xcg1Y}m=cJB6oh^~2`ftjtr2~oQ>hnD+D)PkJl`L`b0fR`AVq21`onoq{ z=kxYdtr`kD8sPOYI;eCxt-AL07X$~x0zFqoayv2Z;uJ2?xX1Ovm42@&Sb`BAeYrx* z{uwJu>|xA(ecp9Y*G2O{KL(hM>DR-*U1%&*#Bc4-6k{%zsKlnDpl3uT8c-)X5Q)>$ z%q<3HZ<BOzEZp^LQ?jiY&=Kvk7YRL=IBdZq!DDYzw2bOwMi1$kd0?7eESCj}Lrp zLSxR_Gt~oE^M~yu=gW=0&47dxBXTms)U`42V*Eq-x#MTrg}cf1%asgXpT!?hL`sI*PAnpv!`urkm*gq;hwf!xoJf!Hdbxuh1yk~>jRgdRlGg89K;&)eI!c(qn zn`CV?j+P&ydc-??-IbJKr)Y$cgo0|0;@=+XNg0{kFP4cHM|c;{xP~uPZsm`)w)cdZ zM$VdgJUi;%w&Osy!Tg%1kM!Q83yi>Qmch>N>tJ;`5dBnv6|;S>^PC4fwQa?tNT1tl zn!PfvnWxKp46V9ruNdu_w6!R;=n(qKl40*n)OF2n=r6$C_p(Mn<+0Wy5p0xs8^D@B z=@BAodF4V+!a-murGNA>i`&_0cC_HgYo>pmbdI)B@x|QN$(dOtIaMX+Y!r>+#S9CR z(1~g7$Y>u2A~xn`z&o5uaWy&d>xz0 z=W2wu9=3b=vc|$Iy~b{Gs*ZeAfDD_WmHF~(08+rwlSH&MFzoz(bs`|r1DShAK&U-TC4?;>{ zM`&NsVeYtUxl!W7o?0z<+Rclpx>v> zjZ?{lr;C?IEHOC9O1cB$-==MZs8^YXI-|RPbu-*%6UEX5^385|i(KuL7+ZI%D z$H*HL_i{>{blJ>a29=g8(?WNQE>h)y6}kK?PY0JS74}W|#Me*$*6Z&^nyuXbjIS%H+2bF#9nFWk(B@>vj!D-h8tsT503pobtM@aPwKuQr zWAYHIA*|yxeF`W+uw6URe{;~0g%Tm^zzORf_r|_`#+F4%h}a0uh&(P~>Ir0*O1f}v z0>fg5jGKR@^`G0>>L;?$Ny?}ZX#$sdX0&Pe_;K*kFS>C_v5jBnITh?eg{V(KF;7Xx%%b;>`Qj`QRn* zl$zKk4!Egwm=(GZe|GJwKBq)kXxV8*wD2lRjJalF7AW>aEg`gr8qj*2ow_Mll*Mdc zs_UyirSdhiM*}bB_kzQ(;*1E2%no4 zZ^||4*U84)65&t91oO&9@P}OE1go!4$aV_TuLHtiS4O*S2*EBn2~U-#&N!@-3l%wc zHyL0pH;auCnwGA_m=t$Mp9A?6W;61kf&DfPgpeVAj|4N(zg(2_8)1n_ZMFOTz|@^a zJ4H&rmURvWoj$1{YQ(7zw7h#V6MW?pLk0Ko-f>#I@(U)b z{>X-uJg-oh%I16&K4B^ZtI}UY)HiEO7iViwLgzl@zMZWXWyS)%w9J$Qnek|!sl|HT zQZbF&#xJ?`{^#B|{{MXzTGmj#Y8H9YqG%=vZE9nxq)IpNA9yVOff^TGp3L=Cy z*sRiXkhzK9a~+0Aibz*8bzO%%PpiYO@dfoz54dZ`XLdc-d5H zY4HquJei z-B&qp7Z~@x_LfYGGZ$u`j!ZP9--j`Fz_OOqvqFNknj>p|ZoN0Wz+-*ZdbHCeJpy4K z%nsq7B5=3gM@f9+Y-gm|eeEXMIU;or)+Aj?tO@yTh26xRWX^i_N=f8yY=Mk+*uSqc zGHg_T(jv3=T;&F7_eK=cg)`q@bkmJD+Uajj+4gMSRBcIWu_&;z(CNK3!%F@RM{Pvp zf^ueM>A$EJ%{eB6q#DlFdu8YT3B24>sk+?AJyYoSZ1bks{~(e8fbjnwH1*09OZw2rA9P*X#BzzhQMejT?pECtH^{kfnj!bT+x0bDc` z&Y7$}B0hgQ0lIWEN0#kflr#-cbf=JV?g}4~uh6mM(?5}idLX7PEQBYFDJJ+`@m)oj z3mk4C$F#0tjcRL~{0t9HNPwIF4Nifa{`JDb>$sE&)pp>1vk70&Y&Esde~wp7mE`}r za6$mi0K48lz!@>7`>HQWTvXi@4V8x!7Q`7FzE02zpOoTz*yHB_L)l9at5h>5T{LH?`hLPD{)3U$D%h zMe%<;FmPo-j(W$hsqE37rZnvsm>@@ z=vQ-Rf?~1x%?!^O)APV|7w}(EDw`^YWrHR2KW;pXX^3ps`6GS0FwQ~ci+p-gcMY$< zLnes*5(ZVz{~&D?5b#;Hy&vU{36V2U}q2iUZx3{mSv7>uVXTN%(gb zXyqfpT@s-$;x}*sB(~oHFYz~~24IWY^*Ftpp}h{Rl~^C6`gn(f>Xr%Q&&chJMpH#7 zpG68yvlx+}M%twm0K3vakeerEmt{_+okxM^va(-|vL*dBz8miUJ03d(*q@AIF1#K7 z%dGnN#c-#QguU6#G)Z;8HId`RQ(HG(r2e10JY3h**49f$A&{gx)WW5U7oRQ>1uAhl z8;olm(Xt-6?drK-G^zB&5?%4x+fNJotz`p<)&1o|A((luWEj*SsJ95YHCWNP)UmA4KBxh8gC#b?o9f|0b-Jt`A5;UT4 zaPI388wYG7W(N*J&IIC_<>yMvok}3c@pgxY7Tz(Y06S$;{o9D~bLWPYB|)`RL}`TX zd8q?><`|*4ua$uvg*e+2mvI{t>bU<8K;bnwRodLWhQmVturyWOby(f?mGaO{)dkfr z2Vs?#1TZeT34pMeFX@X^tZ26$QC#*_b+4hOj4Of-!k9s^$Ie-$|CvtO(zrBoZtrOR z4wptr1*{lEVoZS&aRhoRVZx#;dD5N#?cBNh;?q4Lu5MBj`iP+qhf2TgX$umXmN^oU zb$4+#X739)d(q@!^||A;Y9qhekhM+~-7->PIs~hg82#zlQdVkiXp&jRX zva;m%h`hajsCQ6Iq3FG%RmU09dBcwSXq98pc7X>PD-_FR+YYfOwa1WOsRd$83d({n zYU^MuZ5e)~YV84d>_04i9PM+ohx}eztZ_TiFRVX>jix+>Ift6p?Mkk=UNMuG=-@2Y zqS3?C$XKPCQj$97bg6>!CtYLPk@@uLvRjSczyg4dkmrs3fioTZvZ)lsaLR5 zRQxnP_EZcmHvG(P-z#H^Fuq1IvVmkix1559GWjCrj|!gKLO$%6XqnjK-kW%fxRP^1 z^TdT4H{#4wLhYd*(xS4Z3O(Ute+sNY(G26V!zLhQ;kqU&-BtBf=Kh6@G)GdMH0luj z4*Nc@S_)M4s5vrOwH(431TC5QJ;yKx)Bs1HiHpR{K85m0A{JPOwa3Z>*Cc|lzXwY$ z+`fMTiD6rIdHA?IiW`id0nMT*z8sOt=&=nW=Uz!quAvWO8l)6jx^)?26~n>Pf00wp zLMXE7Otl*{=*)+LH~tqrB>5p-uwRnq&cmhMnvn7EGl$YZoBX!<`>`)riDKSbFvUnP zcW4cNXXfUvtIWpnFS!tj=2&!SDtB?FdZ0dO%>Ag?>X|dLMJ87-m|h7mV<4~J${^@m zZR(V_=$&5qMrmeLp+KFMMx-nAoPDbPw}#Xi@iDI*QH}#sKP3l77^*`d^sUS=hlh1d zNO^jnRRx&pKRo@H&;8M}#n1dI>aGAvwLg#$UzfBBae8qX^IP7{08!>AN@>LWx8w3n zB})Fu-tr@Dtg}r!uv0G#yePM+4iA^^zm%ryCc@QR-h(OY?t_02M&C|l3ylCS{etX2 zj#j5KG2|-H1KCRd*kJz=a=*N}{KMR>RPcY$lHc3re>NxmzuTMs@9ywYFHiU}(6SCi zDz>mPX{zM@{(h;)OD%EoIYmWRK#AZZpl+qvjT??@c)^ZCup=`RxZ$5~T=YX%0}SjD z3!2U0Qsp}s9Q5w*DX$<%!bB8^7SZzmnqJpUV`gI6?FG+H;cxmM-O99V4Gk&m(oj7( zu@8t(Tw0!AxG7%hHK2=Rl~YHPU9kfB;E0o}t1WVQ;?gpxhYco zxM$yqWL>{}Cuis6^#bs8Co>zDsJYW>q=;0B_mUgNC*ZYT;avjeRr4nWFZk14Jv|`z zkT|30DKJo}{+M&hwT;jhoj%8MI(^169c%K+&ScM?9)^V@Kz%boGQ_aU9ET%yIFc|# zaZN{$DS8Ml*8FjCk+y>mbTskjSS8D!D};jagYb-!J+ZleTCZKZl`yR<6$pZ*It>JE zwuKgLK&C0*YNJmd>&F0(kp1@^ET{mpW^VlQM2ErA&d!kQ;Cx=pQ&G?pslMjVxQGmf zrA-$ZsX~HFw1T(pW6HH}Bq_XQ)y{XC;I^D^)TdAo9R^HYkmhm0{k!%^V81ngF%)Vw zYUXo|yV!vsKIdzm2)8L?d@AD3nYXK1oA)UYd;P6u&@4m?zeLk#E6|<^N}K&>_(6$! z$Vym9S0Q^ zQE38+h=525p@%@?jD?YE14JU3p@_5~M0!FLgeWBl2$7Z;B18ldAV3IdX9s7{_x=8I z&UL=`obzA*=XGI&JkM@x?|a|tUTc9=fivX4*hWwbNV@s#B#5X_q|`L4?{U z`V&3})j32{@mr~ZDx!e9FD0C<)O`OmT;yfSKD;S%LeA%~(wutuX*<)>Ub2#L2yEH` zRAxqoU&`CL5C`vmQpfBB$fBk86Q(IjE|Y2~pwoV_8$|^afgURep~|KFmM0z!2We|S zQiWr-w#AQ2C`~_Z&s1cQPzo|E#hP5Qv5D1%lixb@0e$sRpsH2C6);o8H;8rU>=PHy z`MtBZtZb8AN*;e~u~n^QOL2))jJ=Lnt?w)2bvB@0$6!`-$SerpvaS3;s_$k*{aKu3 zWQ)Y8hqxKtZ~>vP8K8XLk*Ex?pd2+Zb^8t#orVJ!HEhWM&VBg@?h4+AsD%312|(I<~Mb@ku( zip+USi?aOchz3dWBS=^m5iFCSb-470q%2w3tp!^;NHE(B%;`NS;HyALzJ7jpJ!wfm zTtNcy-uD*`>I$q;v@m_9tTfBdo*NDvV1{%DmjGy=cYYvsOtYqQ#b7xE|+oDB>XCTjz;}F_U z!>DpVhIR(c$fs_@db_9$5E^G}+^Aa@((rY}_Zwa$V;4hgF8>DGw&R(0vlMN4fczh} zuIyY^gU)+JO~l~AZLpd-+WL}UHw42?wHG90i#pp8P~uC>9HaGtYNbGW3QF?O=f3N7 ziOQI7M&{jb*L$!I{~a-)&~^I;=nktLAQ?bI%%+_`C^m=hSL(ahTpS*1jCUO0JE-3= z`<3*?%?+J>ecH3Lvm=Vc?MJ*(GG$KMjW_|)TR&tXc?Zbj?H=6USP}Im?Q&@gvOESj z&>Ydkim@FvaqgKJ-26zu$xU6xYnX?dq~6?F1*aa|9myv?F63c_58tJs%W@dcB47H=^y*-Yp7j2+)B54hi*XuOJ^I3KMgvrD)c`{;{^vELRq&t; zY1&swm=M*`+X#ZCr4kW_&q<_AMW0y}{tNuhj?Eq$O-A)b z1GcKNOYaSps(XU$u&>7RPi|zb*KbHU;HwcGnDY8uuYVDYhX;|>^foWIuZBa%8>>T1 z)3>H?+R{?xL(+<{NR}-WVcvLiT-&qj5Mb2YKl?FKI1HcSvbbQ1iPPe~vRo6fgD_DL z^e`p(Zb#4eLhT-hDSxD)?dbXMilJ@H#%j!5HA$CG2Ewm@ zByeg*EI+oJqhq|Q`CF7e1spFL)j2$_y5yXrO4{Kzx-`~}y8|5SIh8q;Q`#+UCEIQe zZ)zWM=DHO5xI274DTy&MXG4`a^{*mN}&-gl`(;JT&03{oa*nJxAznI$A ztpkPMCvQ*ny!Y&QK*UYU4(&__dv)}hAg5g#At+4~{pl@S`VPdnvMAv!-kd-qHKAu1 zixlV9FG!A)$PIp?i5!~b^idV77i%?6RA4FLa>I; zW$oyB9D-5yM1wVSMKkFOKyLp#2)S1%he7RCSZ|0kQ9tlbVZ7RKf5w*K zk0;hlPqc4&-+y>^dZOM;=S;X!6@A-wAXf%4RUnrA!e5LTkO?v7_P?y$uYLzRRygbm zz6$ILb69x}!4BBmnU<1!g;x2u7{|sISu3zoul)>6sq|A_BL(Hfd+^IEXUr+0Wd4fV zR0p>D!YsCWD-!X2;asy(p|F|v;H?i{Q9AY34~IZejc29qmM~CJ^{j(KHT{R2N|3hZ zUx!V*WV|312d{ILp+!!?Xr8`^J1`h5DqF9k6yD?%dIoG)TYGZ6t^YYrY zw(=CjD`Qr#J}VlN;YPYpX;D-A)3Gh*+_*p67Bz~1rg^xmMW3`6E17?dx?NFNvh&1) z?Fwp2k>{NAIAE^yqlEze?NP@lKNQ@BrPYok-V!r-cRLE_!XK<8Xx^F?Uv}rLJD3H^ z&p7{O{h*X>;SKN2rTiSXO72rh5Z|{qWF(8sifn4;8A6Af%DScpJG=H4PTyDD#8R9= z-O7Q1QzB6OBG9R^%Ki7k5(i&UmZH5ooZ`GQ$GpomUf>h2X6yr|ArB6N=*AO2LddCxc3NBkIt7y67b_y=Viu?UHqQ$ z$~b{_(I9_I?7H=!9?#O+R^bYHfvGarbMHYF$xfUtX@=FeH6l&(Zs!?paRM`>wH)UG zGMs?IkRauIwRT2TEr{a0DEM|Jz# z`Ff&D5&$9$MqXv6HgrykwxWloc1-8eP}jEWd~N_xQlnE&DAu(o+&;$SdRTCnJ;mRw zPhZWoJ&H%go}rxGS3~RK7=^eUCRhdrI?)QJ-BicC*@3h|lgfrNy`0*v{&<0NXs!wJ z?L!^A0oeu-4*(YjZTZ56^s21ZFt@U7D0jt1)-I=6>X}qt2+Zb4*=JL|3p~ir=C+Iq zeN)_05TjAiW#hkJOsS}<=uZ~Ry{T?8%#QPq*;u9B*xedTI_}hw7OD|~l zI648!;I#}SZ{~Iv8V=vkDY@nMjT}Bg&Cth2<(SJpj7)s%Y{1xNdQM^7Cl<-K*0`(TZ(6xx-J@eikKu($%f=S;PQwf5`lg>QYlt{xZFX_NArYX-f752y}(6ivjxztRWO zEnY6Ry*S7z7_U1>T##8#_ayBV1y5P_OdAM`AD1?f;-+*;Qorl!Y0iwkcuVP99R>4CujYfWL%zj^> zgG?P2d3Bzu{wed6Co@B54N-U{=gj9l8{DF)MZ`3ue(w*gXrEfi-KeJ$t~i-ZWr; z6%E@yG$5`kjv29hT2$5~8C5sB8*|ktTNay)+})&gTU4M0qc(3c>=Hz6kNILTpF%O; zhB{-b{A(qAeETqtYOl`V7>C3Sv)5qUJlEd|{Ip^%*qgaJSOX__(T4Qe22VuJg_v?P zE{Ljf)hTvbAxv)vwOO4&(O(L9F)a2pv* zeHk-?O&%h9G+H{k$bZJ(Jj*x?3idhRS5Rf_rze{Hlv+*Xy!Yii#_>+G&-=xqXGw+2 z`$rFidN8nRc8^QdRwqZ|%amLLDO@x1L`pA+-(v0da5%3QM0&cPfKlaMrc5>VzkgO2 zFx^9uZ-me7IEK=kU+_*Bqtn&jQXC%@dO2Ruru)6mUiop0_3fKFUoj*fra(;Kub}LN zR~c8}i zy_VC<2&%Q)Bj`V@+(=;v;_>QP^WemCzWLtJ;J|lRe{yJD91pyFXivH|`qX(c&Vlr@ z<&f~Zd=q4`n~t4iYY>jH8hd=>IoQE1V9(D?d)55P*cG;^!0P@?Y$a72)J7Vf?%*^G z*GiX{h#ug&;f6y=)j38o;)A3X-!dZ=!6;`J2w&dkq8^X`b{KrST>2*(^Pax49G~u`d zacg^Onnrg4Xkq!q8M8QLlwyE4LXn@1W|2wz7u>Wstp5sY78TgwwW}`)j#eyLIU^{#(T8UpnpnRpSj3eU$`WPR**>xXbs_?O&3m*Vg$cQ0`wv z;uXd2PjNiZMUtv$pLXAB{rf*)>|X5*vvH%XKUn|egMl}Y>R54oRfzd!#KSv$T-fQk zefw&Yc3%6(zc>M{2g8mpp+yqKf!G`V0-!~`X>XB7FS+C=S&VEMsDW!cd?Rh`%Nv$J z82jx}+84kZa4u-iE|2O*RrYmKmqXuQ4|A+@IOR7yYB{U8mMb*i*Mf%)#f#O5zigpG z*$CU{*y12c3GUvh>PU2R)psJAYB^z}4{S{7X~to)-q_;{)lJ^K-$GO9R}_k7Mb);0 z3WfHV$-yYke;Jw50EcM<*u8TiZVKi-!jX4dvCl8yCR4_VzPI?4cX*VH>cb05WTyaM zoFeoJRG7O_0W{sO0G&~6BZxd0<@(Q$j7Btgh`O7uPTSdrzchAW0yO9X-x^hNa_GkD(&ms50y;svv-|iANH*%)-<@q~?ykz8 z+w^f>fe(}CHeH^pac?aYya`biM^m0MXkI<$Q`^AX|E|lXAo!wY?M2v8-|E12U(w_8 zLvW&nKKex74pNPKom12~*;CH%5(drIOR{238K|ys9Nx8EP5}SLdi-%VS;fJ*@Q!(3 zEAYWWDK8wk`2hf>0l-EqX{;(Bl!}BQ>QHzuOl!Z<_pWb#cJH^L{6NJv*A#-TD3P#&)-HVss8+3^p(fo z4}E=_oOA5g-+ucoE6x=JZwxtnU*O`Q{ead4p+MqcEEGAY24Fz zn&GQ>e&bx!G8n7yWu14a2za`l%HYr41RXGobs)ppfvwTrKay`EK;RD?4(@EsjxXr%eay zQ9&dbm0R~Rn)Fuv)=;#!wyyPsqb6m?kY-j}i$^o>Xh5826b!+rF348&kdIt#t4}f1 z6^%ShY-h=26!!17#!oBcLk#}6xSb%W>~N8}E2rm-O7E;S&*kE26#SuKV4|SPxy1Vx zBVMpD8#m!jYSHW8nh*Li+_bYEiKsLuFVw^~AQ9&CMRhbnhb$Qxy;YM~tlO4$qq}?~ zChD?vS|1qKck2}KeMfwLY7})KYKtdgs{BH^nPdg+4z^T)(as$ zb3XMQl~$TqIgi$$YA(EnbGXN?v|<|2IPLupSn-`P;a4w^L(r+RI{Vv}8ji~Gf)Uf= zA+lp!rFXdvfFazkAi5j>UT+8tBXzR4pTCAx6Vrva_Nm}sN(|Y37^T0$EdGQkhpbhP zi~*U*nrQVY;8iTLw3JI);e_GP8ID34{uXNDz3JUuJ40>4P3I5=(Ok>K=&+~;7npi$AX^vqHYIzjuzAju} ztM$~}=eKsMi9to89(~NVO6&EqD~Ar4W^DI z==tzLk`Y9v*QvM&m4O(60X_a8wkovcEvmNtYlz7vMZi|4JwE=Tq9Lt!K?|%@nBo1) z* zRa$5&Gdw0~KgD~UZr-Of#fE*Qk%K5}2ZdKobT=i^)ZIy&kX6TR)6YF$3!ZuAi)U`g z&|GO_hg@reAbBwfFxE_v#lSL;YE{U)pvA>)gVMiaI*wDU_W!5<0A=kIp26>d8}`Tu zpu<)z&XEdtYdYA8cPW^h#UTQb3pt-3`#<%ehs#gnaejk6lXWG7YCQwh#pQPIgMjDt z)AM)wqUwBU#GuhRn|idlrjE5S@2x{1Zo-GZ)|xb3F}VWDJcDJGdgiTnzqk%ij*1Yr zTPMqgB#$(duUGnueVr@xRtqrw1SJX*xl-N&3Yl)?;`mo9V=Li7b|%x=5!dAGH~sZo zhQDv(w%{t@Z#}JGY;*1wncx@|gc&74@ejI#3vQ7UQtLG(6nXDtpBikJt$-NKNlouD z*%}KD=I_4-Jk^N1Tx$Y^bK3}b^A9L?o;$)pRGY}HEsN*sE2B#1Gh!L~IX zfMIzFvtGWkWZ8unKYYUvl`JeKQaXk}V4K80=9EZT9QD3on!yZ4_YTCf``T0ug0f!ORz*9p>hFS!$Mh{FC zTc*+AiLAr8&YNG|%+14%)dlra`T=*ltC_{Mdfhw-@$6QvTt$k*}jV&PmXGnvKzZHS|nqI#wj8vr$IH@pmJa1c)a{_Lr`_9 zT(q17ed&aV2{V~{>q$y!+ZBJIvHHa_$Q6}O&(NV;Pi42U8FgVk^U$=x?~>|5V@wt@ zDr2EoPQ{atvBHWZX&MZs$}KSw5_@DO?v3a@W8??F!Vz0@=0!7Ib}+i5L8@^+!D+mN zUI?Xe=!L0AM$PgvQJf|*-IR;>0Go3paj2$SmX)A?S`JUJ*Kj4r9~HV%GUgwi<*153 z@`*LS%qH2H4&Q64$WAgVKn+w0?cK6vxRs}<-cn`(SBrVbXpUX?LP4r8uJWBnQFWeN z`sD0H@(ork+I7B-ANZ|-nEsH>is2?r&Z$*iLn8YJP3AuKSEgPU$%8%yupi92x_XA~ z(5G{HJ7+s9=Bu?Xj(r{C(7KT;?|}#M6`9PpGObZ$Z4whxh3mgGAvl^3<+|qvOoceCWhf0?Mp!H-A2Sk1RS0T`rn|bU zP`&OsZ#TA^l+4*JX!0{csk3F#0|Ht<2XXR6J}Uw=lee?3eQV>?&dkUQ+>kfzi6!W& zi&N<<3)A#g+URGjGMplww*TH>WlLU-P_t&l8Q*^V`f!NpTFCj#Pp4d!iM;DX@- z)K+qE18109U7NW!VnXUW-%89=>rWPqH?gO69jvAY#pgI-xrHVr21a{*U)>rS$a-45 zYUlz&N=7xJrDULqI?1S-Evq&Q#Hn&;#l=wWET#}T90HayVXURB)vF23Fmw{fb2!|` zJUdh-6F~?$8981`8*0;Q+|yVZ;-td0ZJ745t&dBZi|_{dKu)8qGQlvvU36|JpbK?D z=FYwkMEstC=<}1J^O2l@+J+lDvFlGdQ){UKPvl0%yj9k6_ADDo>|M_kbYtqFjqo@j1du(Wd^g_HdCRuo*hBc3^;e}KTS=7NP>-bSHrF0b0 zgk>FAGx}%}gT#i2tmB$?%~3=rkgNTAif%@ncx^y;vYV~HO{tPiq|plVQuoIRMwxfY zjvJiG$cOtQtc(T;&*41e#%2zXI27McvK^BZ31zZekJMqb8(@?REiCIU(X$ z#sF)Jr~Xab!K{nLX?3&5weO9I3#N?^qpbR?X4luwqX%k+@7B@8KMwM%hRE>Lc1Jvo z70==B<&YQ91LJe^rg2(yAz`cpaVC{p8^KSCNRb~Jo#!NH`1ry%sc;RueFE(4HwquM zwEwcpLKiP?A)gg5z=L> zvC}zxF4eE$EA{H9sb11T-(oaNpXCqYm3nt2?6t%v?Lbvs4Rfpq(E9&+g za~L|QeJ@^6m}?Vfea*$6V2grB8#E=Sndk5I9Voa+%z4Si zFaOiI!fVtIp;m$H-xxmr);@IvhZzi;@(4L=kd<8@b!siG5gpQdXCy)J3krU(xjd^% zOeX$jR+HRk>QK|;Nr*sMk*O}cKP6iRX;ml=CrhkRxBP1}$Zkc@%mFhcZMt>M2t7!W z>(@eNcZM|(#J*Tum)BUmF_O>^Tdrz~5B_5yl9R|bDv?c0)-d#x8F0)AGDh=(VU>6X zy7VNPTrA%K54<>(AONA$GICNcb9QeH9NT_@*(eH3NUSx20om+b#hpArY#hpS1}vP+LZ zf1N?>C%8&!(GTxk@i&H1z)j$-`vi&>k?|5%i3_>ix^yW2TR(I(UJx-*zEizcR{A7L z!0V|qfz>Y9{3%RSbL~I8wsHw$-r2~F@Mo#QDOfv`1zPg;_zH_ReTa)=a~kX_1Na7z z)}GO&hPj(8umbTIooZxr=>5Hl(*oWY$ttUudhENN~ECS}%4Dz{61G2t)F7RPLj z^<3(=l0MxjAX>}Kn&dYx%~pf0GH?@Kiex9xU30BSs(^}`+ahit%*16uqcydzoZr=n zOM|3aWnw+XThY+cW2s(89{qKaT?<=HtqzZfe6FV)3zY;#R0Z^di|j&QZN0(6Fqf(* zDW!N%F!%jkyS0Um#g_vNf@iy(Vm*^B_YYvj6U8whuX0Mydv$+4K@+h@L;3Lw}*|8wqx zhwL^63x;KHOS{nmePYpauw|@wZ~g%ML;21`%B}ZWxcG=u7IvtKNY;g8NfE}ozJQ?U z+e6B~!bxbGsxWV#$gZ~j`Vu#io}@WcE=XhqtTi{Ir~3^}*DPS0cjetPd|mj}Q?0N< zmr;Y5QCl?{A#&(uLw)7EZXLA0P;k;(I>TNq1hDLKl|fzjluLpJ3^Z1|WoM#$BEmnu zeQXOU>d}Iw%C08;%zSt!l+fL&M{=(;p;po6`%ok2@DY^k3$Cb#3kKiEm41|mbC_pP zC#R4>02=P&Rbyd|6es>RY|n-9A!^D{W~#pX7Wnj?w5LpW$?6q*m-=+E5p9X9^$2mE zo;9yGK$M$GriDBmYnHS@EUdOjZW$|>DTY!S+h^B5)w)>72XJD{%MTUkaGFt~(SDZ5 zFO2&*&*YRA?ya4#*1lgjH8i!;@=Ub9Q8>lKAdXEeE!bL9lSdTxrc{H}@Ir@&=B_9! z9_x=NyV(ePT=J}EJbwyj(1@Cqa(H{3mKHBCrP@mWH3n8vp!YTt1o02iZ? zI*?~Yf1`P0f94kW%KD~nF!G9$-{5ov}OPpiDK(aq0=4%I}} zII*bviZXAmeG3Dt0!q`%ShZp(6>_EV(-rZ~kc8Og+CVkoluc4)9ce47cT0u{(G=a6 z3>MW=(v({ni;#RwZZKFqZNs4Rm9IA)MoTD#&c$gQfgYU`0?u|yf@WHjuST*4lsgsK zZRCx4M4XPWYD7m5&Rf;)WekyzNj15ycm|<-%>69Cbc?b6b04+ZF}xf5Sw{M~KKieUGyuEHScFrAojUcr{tg;pp4X)#& zo1GeF$83f_CL1G_3>KR8*aQMDWS)y4=S!l6LPk4!1nqVYpemK&OEHfk?Bg6+oS||p zdrlZ_%}aULwo#;|znTP~Kk zFj#)PU~9K!qtG?F$7jrL!T2!~Gi%Z9JnQo?ATgv-bYZWCqsrHFZ!Y~ZAD3lAY+GkQ zb@F~xKi$_l)l?T;bP0iu#)PB))P1ueH_RSyOxu!I^-BnOp}PA%C<(3TW}?(RdTwgcg@yUAF;mlSOd$`OhQOo%)cy;1&6qh)xa>%{?aNmCL*4;wKRqW*H7+C8!Z8kBHN~dTwwgz5WB+c4(7^J} zI9->E&#;v8;G*oFJ$H7_t~a--X`aw_K*6P1oKs4rk0F_}8292Anxywf?Jp{~a8n=u z14e(R89}L6j}v^bijxjoK5gbt3EeLZU_t}MX4&E`p!|zT<o_2|~f&H_ZyK?&P1xATy>dUs z4cEYGulqv-y^W3YZgq@Q!_D^^Ijg3_pSzt=8Ajc94?yabo=(RBI9W-&W6`(Kpk;5V z36dNe#by!0m?kiY$@@hP>gZ{FyKzJya|`cbZ%?28iXW$@chAl;Lk^?rBJt>vbaqac zl{$0ww%y6rS3WX_$U(78mpttb(-OpOu+vWCq`N!qvEpGEb@nKxcCJ#08;6`*_@2kV z50LBtYY&HvjgIE|8`6CY8uj|Wg2e7!#IY`MA>VEGDiu9jVYQBld7i?ix`EIZvLG&z zotPG=CBUQweA{A$wU4BkGXX33XW?p?z*7JDm>-@-da=R}FI0|~M|vB1*7oh+;3#}> zJsf?~2c?Lw54{zg_oa`D)d0=T>bu#2;ic60Pvgn~zrk5+^-RoS16)ZA%@ojE# zf(RU+>ESD5782LUhYRw5LdocnRcklIO(*dacN~kN?D4x-$=HR|3s`T^u~+Mvjb}v4 z$nsfFOqYfsJ@1BX?h9cDnFhZf*y>+maEP?8=tH+pN^&aVrmc9yGC3(@))aE(@QE+j zRA2)_IK|ib0hLo*c|#uAA!x{;&I=nbbor2ayx@>6d0-XfnM@&?`n#1mL(#)CF~eoL zhka#YR*eo>oI$(Jv6dTpG3Ro(HQ=mfDN{kQ7GPL|{#ara=@$%%Ce~pKb(1|vmV4?5 zvL^J9GkTbIBNv?#5i`Qzu-Br&-uUjo7i6lp8>kBD`3F+eJb%ZR~x%^|1 z2i-!jjokpVA{qJ+q@|Nd0vu77F8|o&6ANHZeWVElvi^%+jMRyFN@+N;d2uv5o*Qc? zZ}Vx6W=oWs16Y)y=Ah2&?K<&-mXd|2Dt=wtRFK%aCSsH1dE4ldq2J*qZwTuZT-i zGZZ(sa9$qA=3Qt748+-z0k}JIz_~cap%igX(ts&!;!a zzJk2|Jl?T2?Su2Ypq}m$B|9t9PNq@QAFnmTUr5*2xI{9JO=SIC(sr^0+Un3@X;G7Gm7u1$*VZ(eVz-<|Pwh}$p12q&*O|F2`BA1;(~jz8F;i73J028E|J5Ex~W9%4B} zeQxP87JI~0CmJxt_9&}!>vO9Ujya*M>WVV=_2d{ejkUadn&#!Zk*mQ;6EckIz~O&i zk-hVPnPLKd*e^~H*#BUK{xK3bobL5XU54EOM^rlGNedu=>~?NRPD3a&?5_%j(p#aB z{bYMDhSpbGpTP`l;ZF5&!lXuYKTo5c?~_Xm(M7>+Q<1=9HjwF+C zo<)DYegu)>s-}jSV(h|G-oD6ue{ZSLc4h0w< z^7quMH+{&A5_8`HSQDBFbJ z{uk9J7OLfZ2^f3O`K4i^%cdDzP$nA$UPOl2qK>1+ z$;X9#hedxJv7YgE)S)l?3-m5h0CQ;>fi=4%%nX*BEIA7m7lXuhsWm(>@*8sBpmKQn ze(&(%KkNLp@6|SMr9d6+^z?jkoUSi~BKO(GG=`GyWo}mQw|h!4b~mrYN;{$5{O$RGJjB+^EeyyAG_-9RZS5=zB9(OE^ zd8qb24@qSCob^{eCMB+l>cOZRo{WZ1QRL%oVm~J4+paTGLI#&XG@OcA4oUc8q{9C% z$u@I&C;600wWp6I^g5DalI(Mt_H~3sM(v~UhgJ6ilPm)V`YIenZnf<Omj)V8?n<%VLKl(?HgNiWn|9=+hKP4mdt=&}x)wmhkx=NM;esz80it>BeY?zK)z*rjb_YjG<(BHP_b-OIkP4(^kl`Ku2g5Z!A_FHx^s zFf58S1fnD7bxVuQ6#q2!bb7!EAhsGgzI0SB-K_uD(P94^-{ey&VsK>>MN{%|Mg{da9e z&blX_g73dnWbgaidk^sD8OO{m%$Y~VM$;disAiHTq~w=Kt~qNnK-F4wpx#K-4>v2) zS~VlJbhS`;UvDXbWS3r2jDo8S<0fw!T)SHrIlP-1LN~7WJ1PFzC9|DaXkwr;jE)ii zaooVLkEtIV&sjJePDXlP9=+r!F3UePu`4Zfvp>OY6@%}wTgOVD-oo$RGkcJN4wRZn z#du;HnUMRt0nxrzKCe+h8;hdGNImlwgpLWOd8HXb=In6}YdPfB7i)e$NzokcP6E#1 zLyVlccP9dE7s<(0tDmOUT>KT#2ssl5+`Vof1(>6qaLbNJQOxc$6!>&1;01IEALVX= zFuH#-vFo)#-I(x64Ny^d;iSw*m=39N%ZK^2WgC3@+y5L0yf@q!ld!8qO#7u#uIp*c z^ySvZ<3^W3#+8?l4C!rX+umd!JW$J2V#PebaoM+~?g(&8GNx~C+igId{be|u6v?mo zrS_c$+|W_yz1rnQH0g-`K7PQ(=*^aIcSkenF4F?7N*i%4?uXZA;dD>Cs0dEU3Wc!Y zZ}<`477cC-Zed852YK4`*d39ko>5P?AMwn;w}7%A?bk)ut{NYi-qjGQ^4?Qvw#p=# zwk5Siy0@AVqdy#$Q;u`1wmdDrevlk9T~151?5|au;MeFwo&urWnp#$T?VMV5J+#?KNHEM>Z7I>EDoxD|s?Sk--~sVIe^jQa+$>=^L@V#(c?7uu z&hSM`^I1kd649fiW9EZWZas&0x*m=r51;AMAl2txw#^SExBuEx&fOOtCaH>GxHaw2 zgh7rd;%EQ1sp^efq?*M3wFt`1>2bKR91^SfrA_Z}Y0A~2vt&~S*I1_9F%MDRFX%R3 z!YRBDxYb>0xVmIr>X(_qI^lJYkThin8ZV!O$qq$>p8(%q`+24PyR;(zL(uAPGWXyA zq1_#=XPvPxI-dY$x*E9RJLdZgW^v)DGiq``1)^TDw9H~rzvTK`E9oRCcFpPh ztQh*G8fcQ+e$`(h_H1x8$gmkD|1lJu$#`&eQGo}qU$*SZ*GmgX-Av`{5Q})Uw|0^9 z0gyS8z%3sE7ibdo4CMTgrRn}%)v#@a?cGrAIpY>imI_R@em4DMqlvV>%5MaaeT+G_ zm7b2GstDsiOc=j#1?OZG4)Uz-b1SzNyY!YGZ4}MBbWbG+$~F-Z zd8omkI^0y79P9x*8aN^hb>5@zWgo0LF%+ootxZnozb3&vCd*IaUk9A$oDH(sRg@_d?**|Ub>vlEwByFZ|yBjA6{|W9J$bZlcSD|%RM9TeH zG{1W-#RqHLy(@WCuwh=0323c)ndyeFBzQz(8DVDoN*J0YQzyA5KSG}Hmu7~0YP$7I z`*r?_iM1?g>me^9W%BmqK**Fm=~7Bd=_^2xucO%}KaCfJ-!$K{Q~y^VF;m5$r3{3a zoinwP50UGNjy=_F2{OGuhbaI*HCNgY(HF*t95}tScZEFGIwlBVnr>jqhZ4O`Mm~3H zSiy`&&%cj@HOA5}1n(Mjc)dSfaEzn{a_&zVb+(!y^>OP{TEy8VC2g+>fESD1S{v5B zZDPm*yVD!L{MoNx+=YMhnX`h*7IN%;;qS>L#yv4S;)PE`jgDr#UHW5dPjhV#pGWm^ zWjTqf-aT*q5RPK%{>eF5<7OK@5H(P|KC*(pt!-={<9lSm@mE%UBM5N?ya@vbw0^* zGDx!#LZR~RSsw#B#v?3X*Zro_L@r{Bqa7#>R9Vs;h3GakVoIyH{!s4qQvO-6?!~+s zVQe;H{x@ur{NV3}yfG$=C9LOI!MqjIdvvj(dq6|&q(71N$=|9OU+2d}yHkhcXn--PZ@68`a>>uD7NbMvp!b1K|GRr2nl^fAZK<+9Nocnz1H((MJk`2Wq@D|vI*cM^JAy zY|F#2Uv5i%)2Y-|eCVSXAktLd6_DUfXYj_U{!_G{mO<`(>ba9{!?ZCj_{{uWWB6vP z`5QXT?L*?{WQ&&8H=W`3@QtI{!DQVwO!+q8GWl5LvI1hVu4yB;ZHMc}M)YkxF2xEc zpLa$Fa_+LHXh5;B9MXDF(V5uad@`~7qo>~(v85%o7I^V6NzT) zrjj&{-t1}12fqSp;>l;e=K|0iHq=J}^KPs=H#KN~3)(1}&Zpna;6iVZdTH*;kazDs zUq)UGU5M6a_2b@$xcy``mLTvt^JiGk9|tN!l^{X8zj&y7<9rq0UHl73r1O&%&4}*W z)OsEao%7N~e{CsoZ*;4$>K`Q~C`~{k7NMBd{`(9mr&C870t`LEN=yZ03k7GY{$gqW zk9~VBi_F1LCpC4uI>!=SvdNT_XbySn)Ox*c*ba@P;(aT=6lMJX4CMTG!YTR%0gV-< zCFx*j-ggS@mxU^Jv71W-BlxzR?1Ja~PFx)dPQaN;gDhH?85)-FQ?K^dZhc|Cu~@-r z?@-v*HPtRD!RfeDKQOLX`qi%>g3pIte4CC{wWUOC7f4`mb1N;sQ#Rb`H5&7?!9B{P z$Ay~8?Ye|5ENmJ-hcWw0)=+d!#P8C2$d_EB?*0y8M4_|lK_^SvyG zAKV9V~y{O0u|MyJ;`Y;9;DbH2D0hL#Z8%9}RP-PRb z=Lp8U1@C!Mm`$uTA|jL{pfVTKrh*2W(>t;^cc9YMaR!IE3HzNI(N1i*e>}LQHYK(U zM~*Dq=TFsL?oDSO=PlH^WExd~ysBe0f~uX6^Qc9k_FtNMC#Qh5)aed!eF^sI{D8%L zQ4CORkOeyC^*b_T`y``n2H)Zq8lb5JpQ0F4m3#_DYY4lnT3x*Pb+*@ubB80id$$88 zDWMw9d+3ITemxBm9F*stUdY$W-uvj8KDAM}&gB%!ii`P(O@lmp{-t*eVG(l18deuE z6G9VK!mGALbC}B4mErQ=f|}Y4lw4s5n6l9?>XxPm3;QB>Pl4)edn@b~lP7y!@szJ;;+wOPeG8 z&+)u=OEpJ$%-O2q@0M>W3#ziwvzrOfp}#Dhd=egDq*s((NI_1}pM z|6iQBD{N79B6ePbwIzo>X{dv|i_VGkX{=oiS-bXcLtL9WB!Ll7Hiasw)x+Q~J`%HK zSC0QZc`QG-!-fJWX;vMQ3UBSc$rV zXl)wexidq;Zy@jU{+e9&DFZrgY=pwjzwmme@CKhXcckk4;5POh%-jw0{r-L$wSPnl zrY3{FRY1ztznfx`6E84?t@4Xs7Gb?5$(rOTZysbPt*dV^C#=rM+|@iwYrw>9{+Pxe z#Ti%#Lg!^h!Zk^(jrwmz{?y-Lqf5VC3CVmrSdw#TK?ygxmTB6_q4?L&5L?0 z$1$sB3CpfXmd2;EQPhSx^sV(8zdBZF$#JTQa{KriD4zN!b)p4RKbLi!B{?-O4XM1A z9H5sPi8gZ!3Pee+vhTFjHi+A64J18ju$38cA;R&MGy)pw90kf^pzB5}^w{$PzEZoj z;Q5oe^mUni(o2!;)xsMQ19PErxPCIIlvhUYwxxu*x%649)ydmN$~EhJ{QU4SCnQYB7rkk26t$P=c%vCDVuLMP*Yp!4zL5pzn!S#rWSM1Gkc9}pKX<*seFK?31854x0u9oF za;-zKxZae!aNb&~Dqp8dpDw;GyvxQXxqRfaBwfMZhg=CE5*%w2c4XlB-rX2YWv&X1K;0G{IF=c7a!gZbIfYsNMcXey zxrg^(izveE^~aTkm-=L`@gr7O)|w!ye^AFs@3PsKcco5tO-_!iXh3eXrACL?QFRSg zO$}n|g%ON6L5lEt`-HA{4it=gFGen92_0|?Rw z_kahYAs>QSm?62h@?cYO5Q%;rLtgw+kN@%GsG8TYmOy@NIFtK07tCa*lTn_9%YL9d)?MBj|Qm zp2migu4*tBXEl1{sBQh`sX80RjqaTWYf8*U?oSq^I9;=e55V};uNjLtydtU6FF>xj z07^_x_AYyOV2O>vOBMH2{%lhkX;>ESVm4^&y4S~OP^l$vj@!@*lpA~a5&Jy>;~i>O zHE&(FR~^^%wHG?Nw;;ZuCRn@>)U!vY0iRhG3EPP<6Lz8}V(SZKoPwa?h4i5IHQ-Jr z$$Fm?)O-J@@M3qhA+u;{L9R!ms+YUfQ(@WNktx=Rsf3-^NCiXD0ns3eJ7|f`@sVq- zdI7($iFJI`5VtLE^IPdz!MFNlts#R3&$qcDK%UH^|3+1JS1>-p&|Uf`hF8gtE|> zpBvS)FjwaeC9F%uEo3%T*cgmmPovH->Tlaf&qa#%(5|Jy1b+rKynCw(b=z{%eXe=3 z3<_o}L-Xl?(@cF~)}9-WFrZwnIcEoZ0&1+pAF{G@?@`KAHGGMf@ng>`#YNQVxK&K2 zupJDf<&)D6<)b4Q*qYk#Vr2q6{NQ|ND-lGTWqTmC>R=nN(#Jd448*ws!5;R+@TTl3 zrx(=mw_&KrmX*-TRcOe|McMo(1yO9&GV=#N!Bujy?_jDZTK5X~KJnZb>bd#91-Jx9 z`;TJ(plmM7^p29fUmlN&*!I{((OZLa{LQ|Xj|>R zM@ytM3*%vd-ze|<`ox3XWhr& zYtPgFw~PO~81vuFP_ci^Ebp~{5|*!OF1}J;W7$+FEAraCtY39ZICads>MG8|Jr{?! zAMcahDGO2aw_%03aR3xk%=u*PI>blyXS^({PY4&s)3zJ`R{~xC&U?em6~)Z<50y*96ickU zyejIaSB`!zbj@fliuR88eCo1u`^A23Tm1i~s`pnsV=*gz*RE>TIsoJ|TXDX3?_R|@ z0Kgn6&P6gOwQ9+c+J=6yTATe{7TT@Z#6>ySHJi9T+jvj{cNV+l5#8l(O=DYJ`c|cJ zqgWr!fG*c;kB=XxQIOY{iHVk*DaIUpufMzDJBqF|y8mX0+@6U&(%M%avn;!-ajIok z;&OWYIgPO=yp#CfqWV7T^K|}qQ#Tz>J>qSlwQ5RyZ>4c-p05q3y{O}vD_t|rht`HO z24mL$Flb!b-}C8Lw#MjO%Y4E+?3!_YW$%?C?&AR0Kpy z*P80hg1I`SItm0eu{LI7X_o35&HIg?wJeW^>#i5a)@IT--c$S8N80P75BF5R zoQSp7XfL#9fH&XC=-<3~&!aJh&(rv~tB+e-r@dHWr{mu4x%h42l zMF0Tgp*RNsNJnulk~!=j?b*(YKx4LjQ~u}a`oBn6%+`mqjy)+{X>An%4k1->UX|yw z73aHm?^c`x0F0qH7s(vx(a5GncIlZ#njr;q4b&V+DXi zi{cyrARWcINag?lKnimy&Yybfsj@hK?6Job=Kuf`D9%MP2LJ$4=qk?Z<#|_ezJ2@l zco+Zx6z3xO0{{Ri%(XZ#mTM`B^M@aPIPBQ5BOV3-0L8gT{r~_#3bPgG#d0lGasK$@ zkC(;yu3fw0VE_P7oQvcS005*?FV4rUb6)*{&_^GAG(7m=gYggm0Q~>{KV{4XlGAD) Q`v3p{07*qoM6N<$g8Se~*#H0l literal 0 HcmV?d00001 diff --git a/docs/images/macos-custom-compliance-02-settings-custom-compliance.png b/docs/images/macos-custom-compliance-02-settings-custom-compliance.png new file mode 100644 index 0000000000000000000000000000000000000000..bc5bda46a55ac95baf959707d449295978836704 GIT binary patch literal 42687 zcmce-XIPU<*EWpXt=Ms^z(y&eAkqayLKhJg5KwxLNRuvvA|>D!6$L4RfItW!y(Q8K zA&H7~NRSpvAkq>bga{!763QE8-{pPo`*@Gz`|&+LDA!!q%&b{!%_`@bd413L_VFWU zk8p8u9oN5e)0B(r0G5kuzr>+~oEC1%=lh&L`#`3*Z*ak|f(x97-`#bLbhx;x5|3^< z9pF44etgFU#Km=@<>$}7cE1uAF0LYT{hK=GPaK!F4@U?MWs|qvi;CTga+WjPp^?xX zTp;tViM0Q3fPK?}d?D8^J-5_7b@tU^u}d$L&Og4Q^H$-(rwTXa@=p(fyPsM$AL?#n zU-E8#2Iue0n$<(Px?DVFU4Iy}OEI4)3tu!JatMT*i&N;4D75^h<&dUDL*U$Vcmi(w z%VsP2u;}xXHxBLnDt;In7k5}xj2!WKtNUNg&y&o=-2`qO5*>X$4f*HC&mq+c-B)fL z>b!J@{I73k-^JU!{Nu)*Yk2^Pf3+5S_b9$Od87JptLnd|Q+0Jtb9#O<+2}I%Uqp0B zo~t=_@p+Q>4S(amsd~O<8X2@H@3N5G8nE%hNoT5rUAkP}gdu54e3fZABr2A54|4h+ zOF+F#l}^jbmOpZ50!W9Re)vCUNOJ6I7m4x?MqNH16xADU{OUib4U?P?{qIAcS=0FM zLmml(hT_=aFpG*QM&yL+QlaCcK+&xbx<5GO=8Vuasi+LI3 zO?p|u8js3G0`AftYYQHuT~*Ykrrw)OUk-sz$i=o z$vf$COW3>nDyf?ZacVO;p|-(Pf@BCm%eIV!7B|sm6lkdL2$WVpE;=ta8ZE9by(L41 zXyJ}$Hb+gc=>h}Ao#dP-IrWg`Bo+6bq!{5wVporfyER;wnx*Aa7F4mh75KMC9FWH1 z(a1KIND0s}xD;8LKeJyoa6XA`O*NZzsA*$H{6k!`<|ZLVBRi#A+g>7FL?hO{o#5#| zq<6PdTUJ$=${j%PuEQp6w@F7BoIe_2i*cEx-yqlN^Hzh$uOa40SuP#o{GG1pI|QkI zFVFh!g4oySnfxBveBb0y3s9vta3{`iZlub2wNpZ*yHHoIsve~og(ifyQ_*Bb@Ze2D zi#H)bLHe6!CL8PO0=st+5P<&|sbR+Jtc<@E=ZGZ)7&wKST_oBsjINgh9o@EhUZJTC z7(|!aa6}}ey7BX7&bXzGY8PgA%gMqtU1R#uv`zSU$&3ES_Onk~ZXiZAv~D4)BM?^w zgXA5dCjghO;KXlg_JUE{qH!mz8%mw-e?of?+@9p$+bv0x`XLb!)1b{5e%m?BJC*Jz zNx%O7%exHXwa(q<$0=L1JiFQOe99~xa92$mZ9>vewIPk~>Wk9|K&kz3sI(EuU-N4- z`Nf;e!im1epQQ47!JgF*%*;{<*I0Z+^dvULL_hAV)qWME6Nd3#`UtZ!!4q?cDsziP2R^Xmgq` zFIm1bb2vYs`JyO}z0UaS%m)DNC@qeg&%mes{@a%?cEEqLE+D6)8$UM|th$;4J&#D3ty7lN7?%C!Nss!o*orp~UQLG3j!oLnUP{ z?_66)2v$1vFDd>vZ^zR@GGpdo&V}zFAt~=iF_hPJ+@rjol~7q3UhSTbl<2GM>~h9 zsq8pCulqgD*0OChcy}bclICg%suA=y+qIAlAiq~9Y@ddP4~JooUyP)klfV2AtEzE6 z*gw)dp{%IUIa-4>s%>gnUq%)Bpf*p4oh_kPcvp@4nY^VoPk!MiA8i$G65%I*MJso1_G6`pP^hjsA zEcOLwTw6-2r2%|T%q`k)S8si9Hr-?mop$N}!l(}149n0CdPca~Ehl+YvUoaz@w>p2 zNmP|AR(of|88QDQhgGk>x!JmV>2`wPiVv-~WX@{PmP87!b8ECUwyNxe4IfrvmXpnU z>(YZ3dSx7I`)qIAA{J>i2GS-`%QGa>C0t#pt8IdawlDZqiK^qhJ@=shITl2gf56Z_ zg{`l&Yp~84T+-OtY~{CUFLCZAw@U`UjksPfRzb4Ard39b3XHaR-!L?MRxhAhY`DAK z$)u~R=>+m!tzhcd=vYd_?4vzYnC~%FD!-`f*7jtH4O1HWPI|%_mPE!2 z-f^IR(^T|}zYkH@V`bV@i*JHcW-6;!5Yn>=Wtyer;K8n?aa~8dzCQ!Z7t3z3;Wlx$ z4~vc2=)5B_*s17HI zf*K2K5#$f10)Vi(=Qw%VyAa2-5@d%5xLdneUR+0kt@~Mac)&ntVL)d}xodyNx8WT) zaOF*p{|Jr)${C>frB~sSvIP!+24DixvAh>k`o?s#JXHzJh zja~^;t5a4UCX*J%+cdY57*l{q1soV^-SD`OdFSMGfF zRJB`cfQ{L>RGp<{hQ_e%5t2S~#4@J~HUHFMNm%pzIV+j;)N{#t%PX3S<5DufWZR%m zE0&|CjARW>pE{0>Khizx9iS@bQ&;Xf7dvD+?v#UZZULx94b~|7wI1|B`KbCPYSR$z zbDL#zre51o?`DQqWu?oZ#~n?@mKa_B3y(&=s{+Sk-*(c6Y?<;wT6IhDp*hc%9bQ(| zQB)`IOUD5tO^YN9X){4JwTguBZ6Bd<7v~|v)$iR$3$aaBrNCH1)s1bXXM-r9+4xl2 zlAHgsT+oalXsc0Bds4K{E6r}Mxvmq8`<`+dWcdM$_c*k6yI!>w_B6- z!(&9|U8d;3rf{|=3RhtyR979)8jt~7)~}y2D6f#jV555fw#}brJ;(DLRw5lv9l9rY}+mv@wjTxo>k<1cD23&?SiOicBzxWJc++5|41RG z#^;I6L8!_tVWRW$9es_`BP-mqD>t(Q7at|7<`2#IE4H%|HIM+2CprO9UX>b=4yDJM zA2u!BLk^rF$CR~oexl#%K7KT7_TKHRim3H{loidx3=zScuDlmGYbC4*ocd1pw#gHD zDMON`yi2u!c9wIPBL5Zz(?LHCtx0qAuNPXL|8ZtvcfBUZS}1{TE&FrOsdd9CIEr<4W~k=U5w9)j z@+G>BI0EVCS^Wr}x-eXSLvAR!nU6X7sHTVF7Mi#M!O3(+*Snr&AIWeBtCdH>VIMJ8 z)$Q4@v*oNV#RVYGghVcU7xD|vcF4|Z4J|t(BH8JeIA|fhYw_vh+;AqTl*jS79F_rW z)9~BwKKNFR0=&4PG#*yjUKnh<2owh3->+!7fV7CFvZIMvvn1KyF!F+l zoF))z!;)8Y8cm#Qb=|$4<}KhO@_6gHAbMKT1HGkJ%5J5Yvg1@-yOUIt8v|hx_NO&w znmy8_$|X8XK`~zCgkZ-~2y+QNSd@?&FvPJY7O9!}zWiiuuznT~Oup)rEu^7S%;ICB zqpZX7Y3eAA7}^ij6k!(H{w=w(Elcr6+sUt^!^6Xil30tihp58BR@>9tu|S9AbMWGU zZ!3SfgF%`NiRhuG9M869gx{B6(j5PXur6cwCre>*DOo88$}Qd)m#5BH{*_U5$2cu9 zSXIFCR+gUs$Thmg#R;3G^`)5?t80(hjUVX?@WR`%^jf$mZdzmQ&*J$Lr>b2#KC)d| znYJGD0ME*3(nrIU*^$a_6lV4c9-tzEWWp?l8*5s7!v*aj;loBeW281g`3Jzm*0J4%)uGiD+H!j0 zORWn+7@73pZizcHuJZaVyu7QMuW>z7-kkxg!jA!Cm(f0*b2dd~r8ihPDb-Tg{YOG9 zihvGM`)N@)ZDW-TW^+=f+m?62LZ{fNEU;l+vxRDV&0r^Fw5Gxt(vCHijX!?;r>Q-6 zt%51rGVL!? zJUY%<<6mOw_U+<(TIzBarnUVje-OjQxa?+P-o8|hlC7lesHoQNM0JrRv_Gzgyg>oA zB#{nUh#g^77P2Z}tt@6XUs^cLL?qMcL~1fbb0?ZjJZdwe5z)4J{OFJxdFQw0Zrg`* z`!Wi4l%#3_JURZ$(70(0T2GGE5S54f_}Jt?#LF(wtIP4)T2zDF%Wd2>J-^Rc5 zDJrD*EG0^C?SuVxiU7E`0=T`ZNcr<;wghOE(akPYG-oWzy-3cxgI1)P^6BXL^aY5H znaU22OzY=h z^3|FpVB{mb6WoG!27?6$3@2Opr%AtV;sh^VeN2fs_Q|XDh+Zp52*`df|GLu_*qx*G zhbq9zg#x|+ijrGx6S)b!oEnWm+G`1`-)LHvO>u6RkjY7CGSZS1x|lI zk1Vr=6`Dsro^Z*ik3h*dpdCpj+2>VytKHvn!~7$^b+0BcMEp9HvGQTJNJ|Uvbi*yX zk1w{|^0Ss4p1zXT8ai^8%u^7%dhcES+djQ?Jgy1Y~|86{bS+B zz&5hqK0MNUSac!uz1ee-^aM4=zVv+}Cp>!|qc1MC=vW-~;%z!w$+N#s`+K!PeQjBO z%8RmKEm};paQaKV{1oyPLkD$iCjK_XvODwm(G)Mxxz4q){SB)4K=Z}ninRE+LBD1i zKa$qq9#zg$?ya7=6{Ty#PqrP6Y_{;kn|C&s%~fCWzkc@G@7o`4AQO0xx~^nuuE(T# zw!%R?gE3BJJOM#kvu4_tN@UhiRuN19ae7N5L=()|mlL$OU#pIXyZ4F6v$ksu#|<6x zS$(6thiz1mSu>~h1g?0=&u{W#06kGJlCJB~xYoWpO2?#}HgS|_7eVMWwWS&0H7^!Y z-iGTLkBJCoV)KSl=E|gftB(Yx(zb5!&UxNK^ots{Yn~?}&Le1x>8>8DN>D^s>{?bGyzV&@y5qk!4ol)L_bk*6N3+0@FJRbtg3UkJ{gHT+ITN!;@f;(;OAFFpcI-O$nV<&h4}PqUqM-BwP+Z zU;x>Wf5~=v=KL=B%ebl;ZHiuRBWl|G$2Nh+1 zf=J`Hh!-qCWZPEyhC8%g>rZnBI&=a#AUD^a^?w6So?ey8qauw_6&hQ8(Ten5fod=5u%)%079KYNXyUB3B6r}9i5t*ZtP(P|tVxn4<%yzW$ z>B#Zn%Kp(&54~+0@Vv)@i0==f9Haj-m<~>frYic6RQ;a-=t5yGIfDr~`Ck~L#mSOu z$a?!q*N8~Hx(d-8_y=-*pVUQpx7y+fkkeuCayTx){=~zaEORSr%?G@Id+TdLOz_y4*bOM8~^wY$|(Fp<(~8 zPUj6cKzg83YHF&Y)0f{VxZ}rg<*EwnA7!2or4*fi1QHbGLzDKsiiE-V8$n7e4>#3}TT`F800hXSIThtFQPz zYkHTwTF!Bq3*xKfPiD< zwSq=W%&!r+j{G$ZNzyolFSKQO`op}5XoqDEQZ|xG9!4F7IQSB*l+`t60hqPc&?eBW zLiy&uyRGW^8{dK6pX0!-ny%ZUn~(eKyXep)us;-{N0r+*oh?Zf%&~=jg>HJ|s_Ppv z$lsWoZU*l9y@aUQw=uoFpOf_%>dT=ia2?>J7}e_<{M(2hFMi>uZ+Kd003=s{oYx

Ws744QTvN13Sgb6uurG?WD*oNXsOVa3 zckayou73N{>8+_45k(bl!?a4QGNKg)a;)jlx}vvisQGbOr|gxoNV$dOAVuNm!;~tb z{w@|H48v`_Z#g0n@|&76jG?JaJnfMN)whF$rzKV4Qd!rY5DnKg z6=@lkERpvY%qqAi{UgY~{~~#QA4gqoLZC@QZ$RL*z{Nu*ZzeTe0&g5fD&5Jdsh_Z9iz9yWO)tcm>zX3@e}X{phsY!DR8D}-2Etea_vPe zJP`WGjlEu7~1-x__9iFG(V4{G_IAw3Ht{8tV0>xr}){YE`rT+jHy(dQP z%3prQS(3ip59A=@!1A8N=T-OkchYh&th;-5>4D$C0Hv4o2i#LjN%!=S@&E$aIxLLy#H6UI(e zA2UeoECqzbJ|MGT$?Rn%ntpY~2}C53qGagfbqT|K|HJOPe0_9*cCkMS3f@_%k;Kxn zK41>gm@3VHkS;%RD6HQ&GF~RVRuhpP0|vK-r__ z)xn?CaBtfXViy}7c=o=$`itlDxM@rCc52ujw?63n?7i2C>!kco*6kTsn3(l_Xy(pYM97N)`f;yp&z%3N$WywDdQ%Gs`gAN*LlYyj*y0W zp?4yam@cUvZbJ2qgM{WUEPA4_wJRqEkSM_HITo(#&1Y%>e%`(*a3cDvR2QxpRB5lU z^6?m$@evYAR`bdlD^5_zxqT<<#NND5pGaE!qurz8A{L4^Ep>K!tFq?O;ej1<@IX$e zs~lXzDcIFCvbj$%^qEvCX(?n`SR zwS9N%UVKmwkqE$tC8(Yd-B$R!`?NT1Is)tyy@kQ#$VLUvxol2eRG*vX=dnS|inGhv zfK7{ENzr|ray$K!=v-^7DfCK%m4W{K*XFDQi2~Z5JLW8P)&e4LvXqW#a(lVeUS8D2 zBRp}DAKfRX9iBI_!)o4S@b!FxUkNx>z?#t`= zv4mS0iY~cz;KvJ63xn&q5?8yv9;MP+p6)BGHW(kM^L%rxz8-k_G^JMP7yY>=-Q|GY zZlY28ZUp1l=FSXb6^^SL%}CnHoT>`LMxn!+ETCC4Maf`)M;lWyJw4-E@aq6cIjOg+ ztJAYu;myxiM%3$-5)g?=Uy9u;lKWkz7F{-`<>3&ntg_*E45U(K#0*2+>QkV1 zaXuHDc*^UhtCpFDt=?W%eID_72o`Wrl-!^OGI2+VxjH?NfZv zch3#-OGzIe=`06?m@*u*B6b(tHX{*f#}dgXBI#Va2(rVtSBxjq0%j0cV~;-)QnO{u zw3a9I`bXez-Erzys-2GLJ1^j}9s267he{&dR>du;!MhlcX!*!LVUpKzZ~UibW*n_+ znDk2Z)BJXs7+I}AfpaQ+fSu>Oc-9-xZndnG=K`M>=}FTELPSL@2&e<^y)IF}{d4#& z2#8=a>(PyewJH+Se3Om|g^9L?3f_aX|K6(lOR6svS;KY(Fgd#R_+*WH;u~RbIRb${ zQvk?8mFi)`)}CgGXo0S`$$GENvQ3KD%X>!6JEjR5ml6fY;;H-aI(Kk|?vGkGUpTw; z+$+8*BB4ym(|53FNl_YX?*N35R9iy}E@PdaP5&}7Pj7hm`lfM!lYr5N5ICZ{aJ|%d zuKtIh4vMRtZ9wS&$%9W0FPuB zIFZV8(DkM2Lhsr!6d>oaa$HK`##0?dx9rf0emS$3Bkeg#uv_d;ExFUpW}a>dDO0-G zw>q9a|E2d7V6V@I>--9SfU8p+? z(b+!%;t@2L(aj+)0b3^2$g+yHBO09FuAsiuFq&O{U>8ZUQ1PoOKKG%3mIC7}@+^P% zNM37a;p2lHxzl-yzNxA(OrQnsoRV0O(c)yh4PhR$(>G0MHg-tA3d_9Qa7;GsbF?W@ zgd!a8AcGzX>j4EScTHF67LJ6%Rx-B-*-jP5WQCU|xfxpLGz!eiB52ui9`+RpMyOzN z(^;^*mi^34GVtcHBvbawu4x5bQ(C)Dv}?!vtInh?^p7Z>2~ASnMgd0KVHsDnUBmx% zyKwla4oU8p>{((KuYl`uhJ|@kPZ8Z?MeBMtnbHR&vBhw|w5TV!jyqF-sZl7c@FhAg z*)yvK2+pp`8&yfr9_1xVS%xmlz(1tVd&I4NY!`L@qksQ`fLm3Qahq6NpN>v1f}NKe zd>;w}0E6Oc<3NV zT-kEIye){6ABGJ@`JjcHK&gael5lw3Y||`vCM&Thl@IlSgc<=VTetKIvLGA1pPrX#wVE^Y2E zkBUcuXud!Hk>zi;rb%PvpHyKd;Amq9;_SJYq@DNBDS1n;w(Jy{rI+0g^Y=|G$@D6^ z#42A@_3?L9yMB;INLtD3Y@w2>vDL&wL?K{SHQS=};p0zSl5*LX%NNHAQ7DHo%5dj9 zg+fK~xasDB?4WW}nZnan`q^jmQ4Wj4MsF1g%}fsj6gw83csH$}R9K`Cx>V*5oerG8 z3qDaFOf)}u;%!y=VgU+u-?Qi#{s`@}qIJCglr_8V>Tt)qDO*X6z@lq4cJdC~ow+*u z3pV)3VP^~7NV29C@#=0hk*X8YSZ==buCEqBr8E<^T1H9gF!Y&~dQ9rHT?MT&2=2Bh zj@g{5R#sew4AKwsR1r@PGwZ5u@g*W{+Ysc1WQzs>SwzOl#9o3rTorkvD;R>L~@* z=W{=t4tPg0;8;LB{#qAs64BC&IK93R3#v2HCdJor;+K-OH%}i9Wn1{BJu4lZZ%K&{ zYnry_jrxnP_{hkVMJY?k;z-%53Y}Z~cSDE#AR~d7`rFCpXCa)*_@g%kWfmxah*%*s zV`dVs_~2ft%=%r!VfcM{D@MO^<`rZ4*LRgy7?Zn z7)VqCv6FzFX>pFoaZGJ(pN72P!sKlW?w2vd>Y)YhypwFYz+D-0Ck za>NwkH#TsAtkGbHW-j?|E^jylw9bavRM&k=k)A98F>{oh8k&LWy)n_J0v3zif9EYP z4eH6xm^1K6KGJutS$lsh9 zLxne3WR{nl(v;&c<@AlF9OxhR6-5RC?)tCHor>XLj@5x@g$8{(JF(w2Y27K?_w!gu z<^E+mF17H_b1v_{<9&|^E46_38@hl)`oKr!9n5Yd9M%MG1O>y+Nw@B!blMqa0ups& z>ACnb&DvXAI;KoX2Rz;<(_gp9*Kk!Nf&s9p81@e4 z>pvl7Er}gSgGr7lu-?q{(O=jXM`Ggq-bzvyO^G=lX?pXj{Zt;+s8^5TKx9<*gfe%c z(2nLYEiEJ{^pVJ^#jWz#!2o$D+Fp*pf_>!SwiuuOh*kZSq_{ul4_P)n6W!Kv)4kVy z=Kc5ItSd{Vym_qSZ0&qoWUZ04%K3C_&kM@uR3bbQ-l>I7Za(g~Y8bGQzIyKqEeoao zT{$e6dqTx;A=CDYUOrJ`J6cZ{#~+a$gyWY;mG^Roc}7550ZbX?&@E9Lfast4LGtbVi##W7>HU4!WDN};TrSEN72~9&26vO6mka!fLqZ8 z;^Y1C*0|#h{-Xn*WR31=sr6-Ik-#M<39V&+#YNNl+aYL6<2mL)MiYSC5YLI@canT^ZTb+!F(}p*`ORRS)vKty1zTxF7#*QZA_cl7Yv_>&w06!M)DNp9+#&4WvbD(6KP%E z5g23;KB1PO7+i7;M~Z*IM;@-$IqmB3of(q!Zc(LnoEArjqZ5`B*o%^pvObuIop8%>l?^$PW5NTF3HoE`Cq=1$cV`tF&xhA)8DGcg^K3jU#|v~Zp2!|uyvkCi#^(${r=m?Fd{Ve-3bA) z{gvDMUHg(0svE1MeLj~3DwmDU>AE~#ZPB;*8AP_U%VM3VbU6?6n(mlm!Rb5q;7&i1 zrWAesKV8mV@0pzbTpmc)YgZxS&|8 zZu=Os?@So_Dt;7g-F8AYn1;)po>KG&x&NgtXg))5CNr#=jn*$G74-%^G@H)4t~5?5 z-egCX;G>LJ?jc;Kr4Bb8(CMijV?t$wrJVUy4CWuJV&r>hdG!)T{=S`aJD0~|o*&%y zI{8ajed@oo7BKW89X1br;~E4k;wKjq;(jGFxwKq>gxK_V^V|N8kBS5QC+nU(S*<&; z`#<~MhwzV;+CjW%sh~Ffc*LIBSv&jF-kmTGIzxUDT*gaw$fovBHX2`Q5{WF=x}4V9 z`)kL)I`s>xC{~N5-%u}%1#Rovr63+Z%nm)Xx4&F}VG@wV%h;n-b6G4mRLQ(e&i4!{ z^A~|9HGj?V>r<|$PdKNO#isWjxL)!9U#~b>8FBK-^=nJ;bOxJJ2{#T1wI3h+el9&} zXKyAB;=w7bM$RDPT)t+$2+$P<8WJ65|L1#H7cDR}f}*A$DEO|r&ak3ACD<>Osr85< zx^0uLFq-2YRp-}N<*;xd>iim|zX%nuRFk6U zIblliANp$|V0J@+=uc|Y%jWr3&QE2~CUN)2@`X`` zQ%oHs4n!ch`1__Uks3?I3Yr`5#KtyDmR?QlmOVojGhR^YG1aKkb(;(;w?2&<@&*;( z{2NhWl{CkKP+O4?DQc>LOQ%&I*P8hf8*jKRPl&>o4W1aR65Ju>)6Ldhr&;v|lJ^gU z2_H~uRef!C#1F+e{o@U!f`CrAya zzjNx7K+JSAu;|Cq>X;;g8la(iQNt#en?YOz6#uA)Itv!iR6?1B2CQ8A-&*CLZso7l z9ERSS%093vcaE|p@{3lb@R_b4h@7&nS+k;2j@KYo$Iw)>4gpenT+i8lkR^a8&J zNV6(@OiHt3{Yv?$jk(pDLCqmW$m}K9Hx=K$I)#~^e5&R+8Gl=yWnp&>;@jS{U*3yX%)&##yD6?Vu1I>8&Jrbw=hVtHAb&5H4!e}wQ={s58nw%clA$j*e!5>8QPaDzem({!kh(UH|+B< zggaHyX7XOnwL)oY8TiH)|KUJC9%L zx4qfUJFZG$qZBt^m=`^d=zWM$^_2?VT(WuD+F%~be4m^=_y$C)mYiHw=Omt{uy_yb zl@Klas{*)+6_?HI2uFSWOaU@BltDR~A!}kx-5ZnZRXPV=vrw<^Ud^lwb+w=d6C0ne z7602y(2YAgd+PST3?2V(!qoqdxi|_Ro>|{Hu8iwU1D8jzIX7wk9g@XZZ{HSJAqfQF zn;({zm#0WTpWJARKbLOCCu98|en%^6KssQ%Ku6K3^Nxq7=g<2hogeh#0t|e7D*Xud z$(QBRJ|r6ubHbHU#r57o(jjO6$$1VLD1q`b@=|ZRa;bmtlb_F?{#!^t9oppB@P+Yp zjI>cD8_YhEWgsaj^){K~U`p4P^8pfI&A&gL7Kcwqkiru?M93%JwOef&WM*X{>&y*} zjN<+5fl`J`Hwc?$)b1vL$vZ>;`)|+Kd~<`vcsI05rLR5=XX}dVnc749+G@Kaf|_m1 zT5C)k+(+JHgSXXmVSlY9{+rIwV@N&Al}7l?CbV~gLOCGrRebkq02|jvH^Uu9Uh4<``yL3P zj!P-wHDt4bD}GR=tt&=HN-vB-CbAv;pVitR|P#-4nkO<-&gU}gbd;AavZ+3pp>~5i!D4&Aez4F~28jrz*WHf)=QM0Lb{@@36I%NvTnhUXPMWhV&UtWAdYnm(l zJs}k$?yH5fgK(!3onABvr1>l){<}!!EqCw3a{QYJTFl)$oZ6+v%GcA1zJx|d^@Gp9 z5gUDbf?87!OLy<@_661kjN2Z()L3#txZ4p{Sn!oC2rlId=R-!tgS^5&d97Tkcp_08 z@NWy;+=_>HyuzbJPp7?kS5$O~60OBAYx~a3)5{Ayqo#mY3d!f49OWgK7Tz=0aJCg8 zmG-*fuB0_xs^L*Dr>f72hx$>gYi%yRTsRJZqZy_s{9>+f>` zTwGuOzrC6+pv<-hYz**8FXFgP&eCz(=_wK>U7X`C6(!o`K3riZv_l^M_!(Z!3;jwl zN`!W5ZJ-tCyD-RVdcY3I;;&1O*w{u+E>M07Nhqr%r|ob4z!eRJ-$MLO%q>Rn0rPGLlZ#+LTT_qx)B z_YochU!cBl8eFUDc6~!oMhn+lFF(I@=43dIAm};M7C#K)3KaPVEB5Mt5=W3@_zi;< z@6~SnE^5ge=yM|GLVOGe{_rR z`Exi&8_%o#V(Da&)*8J{6}Xx@?PSyJ^^Ab{fn1(>3*uh=oM-d?Bdo=_*UtZ^5Q^ z1DD3(Pl#x+DG=!Ao5nffVQ68&Ihi4C^)gK@C@3i4`=@;zR&a_9iq37vMp4Lf+DFgU z4Z{um%$PIO24Y%giiDlvrSsuf6bQ|{59Y}~vkoFZj@%iZP(kaTOcpvv}x&aMB;HX7nv_Jz}9VldF`FpF?Apy&{`Exu&Iz*v zHr5^k1cHoRgRioR`|LXz#2Hx;Fy|aSW7y6E-q29;K{DOzcB~DAc{?L=dGM6rLRbIt z7NL}0%7!H`6N=RsV?)G?i?kHLp>X*UOnADSgD3C&!Ys@2o^}XJUh@dUuxCfkmnO}{ zmGmpAGxkHyP-#yLe%wymy*s>|BZ`5p@-Nr_QM20+5wZ0#XbZ_MW*Y=4-wN)Twr7;` zcM7;FP{iw&OI7up5yXGSsU~y^i<(ky52{W|)G@^fTmP zHft@;v~^Q*Iy+=i->#BFbFl(>vJ`1cn-iso;nL)@b$18E5LirtV5lq!MD&{K{ z%n1ytZ|_MPld&F!rM>EOTp(Bi|A4uFVEFI=%k<`k5BQKieolsi zzb3EIGsn|4&RaSDFbWY!&v{dl^xUjgU7Q(b=(7F_H0K@E!;F%sp&$z)*BPtMUf0+v zbIIKJIQp4l4M$sTi(8QJBIV@awZ*MQB2CGv}S&2YMNKw;fl zPsZxZA2oWr?Tgu2(k{=}!*2DMKpR0dchCBxBgVnmljMb_!8!_awyJj-y)GVtz=y0i z$fa=O%gc{ihm}-}v9&-%ul3{`SoznGhuf_Tx=TSgM);)Hh!{m#oS6+?W+<}t*x{7s zoB;HPPXuKj<(I2XP+%_16d~&) zfLRYGt;n0C)#D^hix){}$2Wyb@cF<*tu#>cS*3Z~o@v6Ca9KO64$ywUAturh>`g|n znD<2R5srS{YoG?__7mkACd``jZd~?RE7a~F^L)v7C88Y`=Q6_a3Cc7iOIQ^%+qE`% zYz#ih!+K8&AJxd&+3|-_Cqjq}Do=RM?aj%bJ7jma#4(1YZjIva=bcA1^Y_rQAMR)h z25LW>RAF7ClL1Sp(}8l^Vb5UlcjQ_Tn_#QNY>Wwn`5HuZ!V6tZ*rDh8;oM}nxK4`f z*>JwAGXw?ry1z{mTaSWkHx@p=ee#>VJA_jBA>?2{%3Uc#-Z4wW{27AfN?Gq>CG3P8 zwsP899aehdQYp75(lSlO!is6@ucf?_2S3!{jJuj{qMc?+)biu(vJST*kb6+Z)_0ES zmB=sdVzDljW^39;PV+UFCbQqvaD-k?DMYjOu~(QF32gxd3r`BZJFdmtDIBH&wXYtR zi^E82HP}QibkD*2|8sg8| zT-|UB&#K|WGyt@Xu;>T1G8V+>QoJ2`qaNf#t(h|j+B%S5$^PJI*2$!@9}v@jP^kJ& zH9|sIHKdc_zLJOM(?=6x9iRN3D&~oC{4_W?XifHyJyDZ%%`o<(X`AHu+QYk=_)$N{ zI4Rkdu5+j@|2E}r^=*ws>zb_r*QTFpNe9fM%e;pcg`LU|gg& zWG0*WbVt*iZT@!7zGmlaFXaji87dSjxy!e=-&HxpqdH6>z|GZogwLHkY z%S&c~2Mll1x0fI)-pHMrQ-Q=GdJjVYN^}YJ{qh>|Gl>Y&iLyGdUGbi2^NlFN!o8zw1}0c=^bi?6sm@~B#^+6A-;3fO~9p?2Wisc~D2n*1eS)}FPb>7GIbYs41I>OH^t72qW%5HJIK=y&Q z=vQOEaQ}%Q^o1>iGDd+XB_@4$Fa&a%WAC?WS}IMidYAH{WEyq^%@0wWS?wViFT&)< zzD>?af2s5~ec{QsO3?6gW@aK4nKE?)D85~$XbAuhuXJ>5KF^3d7#_9Af7$@QMTw51%Mj1KI9ZQ| zT{QC;7#uv)B!A}~A~*doDUx$O;X}Hzo2ZMHM9IcCoI9WB!u*T-eacznF7v_6c4<=G z9DVE=>{}j&FD6opj?QW=e3<4&V(MeG=(YnB=eC=o+lJsu^TLv(%`?hrV|;| z>?UI}Fcfe&%L78eWp8R;qahscQohtvm}>K=)b4PlN0`vbyJR!=z_w=6GTB1YQkzL) z<~RI~;tzbWqi#KslRNs&ppSWD*G8WSf-cY=7N5koo88CV#|--K_&(loy?K&8mi>Gi zCA1bMNMcAYz{Xv)h!Ma!MLsUBSC%?)^xp8X*)sfzju7aGM6q@wzBeOrDdi||MBWU4 zjSbbk6J_FO$B882hpfJ7{{XGmb4RclB?{H2&ArQS+|SWpc5rKjX!`a(T$h>pkhlP3 zwYCVU_bO<9H_3_Hn#)#3D-s+(h>Ls2(=mUVImf>}j67QD=TY``;Vp z-z~?x#d3>nu{b~%W4rU2mJP%zaXoQiQ}~6WAI?;Xw!S>!-hDBLrvt}zPbfP z2fIExDAdOZ|L2;9UX*Vi*b4taTf!la^cd<49f^1jI5xRR`@e58Ax(?k?x5j8=!&^doGbW`yF<~%zNbC;XZO6eoA@9RFh3Ll{ zRH2ln7DJc6sHm`e;>fABkXudQ1(@A8q67=@QF zRP9@e(h}WPMj3(U$w5lH!&WcL&3&Wp)YrM3Ae{fPRn=#cswsuNwgE10QDnKTtAj`)K9c1&Ti_CuW zGcvW>_7=!X)2nK`o1pDo7UaVM3?GsC3(s%&O(nNFfNG;`92wd}UAW`?%)=gB&q4d$rAZx=ohY|2$ z7FycVu5X1E%-QKmk&GM>I-9x_f`;p`hY)LC1Gr+0O7!ojN$*HU-Z~@sg5p zIWeY#T#*6eyA5elK@(S{V(kS{v3MsS?ndJyd$w(a%G2nn(;2Jz{7hHPal*H&?2zHG zQFllX`ppyXG8u>JnPwfTGbJXj?B%fO;M?fO~OgzZrtFR z^0}4jQq%E4IjRw5PN(us1DqCax@uiFSl-`^w!M^!`tF#hslIgqfo!r&vmEz&hlG20 zR#pH%3=iNc0qJAy|A)QzfNC;r*M&zNb<|O2EHH?G4Uw*(6ls>Rfq;U55Fjc@2B{%Z zLW>OPC?P}$B$5z92!Znk7-#0&=j?U)KkBx-YWw9=V`9uKuZaAMv2d(69;6_qXD)Wl%r*CQS9lIkPV;i;(g; z7)hM31Tkiqd{K%nhbpbd3t&Y}jzMI+9fl$ZV(R%iChE~bf~;Zj{0m$wz9c`fD7PyD zku~kEIA?ljQOUN|n6;%Lo&FBQU8^#&@WuQdu!ry?cCeJxPaxLcr=4YmKV4k?YucAF zl)El4ai1?L=DmO!dn2p-7wC{G>GH&ViMXxjd#$jzW4ZS|Y{uyjRMbjgp_WQ@0s_`mU zJDqU&XM*P`yhSRAty1YNjDJ}k4!=2&qDK&zV&^&IBgbery;6Z} z(|>>%frR!MFnPF)b18b8ag=6w<^_QDZC<;PuE%WMS6JwY2QYvFyB$q8gBu#i*Lbr& zxHcJ+KKiiQvtD*_u4{Uj>CiE-A1K-7abx5|YB?>&AAIP78+F%_p+*O{TZzVYgh-KV zRgY^=qutgW{Y0CdtYNZ5Jv$?8sIM#7yuRC2&JACAf=4X@v5?jw2k#qDfvw6-hsw&THl=MJCfG63Ti2Jdb>04V$|^@1AJ zUGH&X;N_z*LH~=`qmqpEqX5A^T@)cfm725BhiSluJUtEU<&NV~Uxb~{FTvuWrT1?R6dN+W{MqLJrbj|HYYvGC~5V;3|lwn#}1l&6^%}<&$=m16K&06c3 zjZ<_%XN=XcPa5rSs(e7D{+%f68|NQy&rpq^Ym zB8_VQvDM++o{z<|up&7|8@+f|TGRU-2Vf9R3R%qQ^)qc_LhfTdr57m}rIM7n7X5+B zCMy((elP>y*o7II!^~wxM7*h%5Dw$dpMygmZ{Oji2C#j(^%JL{*2C#9f+9Zbx3LFn zJ6ek@!PhEkO`Re$cP*qYen;%5Cv4+&;uLvAwRm2W(x4ZUr?#0lowa2EF>)UsIsu^D z&NU`cBzIi|9v?ya(3(u-0_CQh(Puv&14ODvLAR!co2!5-T5)-KP2NJINBdUxsZ%zn z33^l3@x|j%6wYppMb6Arh>@2>zAv6$Dpqa+5F2IJmtbi@ zDcQ^zn~6XnyLHiH-f!p${lyZhIy%Dvs%LMtpdW&G?nd)oaXSQ%-9I+NpA{EeA*c?` zXx2Q}D%z%(i&(%4t_9s3eJ(9*uJbqvrAJ0ivB)m3U%L#hp>@j*0h9l`$V+a`A})AH zYYlf`v^|;;GMfOx*0hHpJNh}a10*l={YT0S(W%LK08ntj%o?cqKaOar(qRaLHh91eiWRA2FWEa`dK2=BBulH)j;HEv`VLE^cv1uU}i^_Q1F~ z_+oK|k~pE)($Duo5wf2MP_P8y^wWxlS~$s4(I^?yZ|) zj%yB?Xp9%rB;+Yb!oY4)xi7)pZVC113l?+o@tvKdd-)=5|+j{pp4$34$;QGy&{iIO31btn zg&mo74#dp5ijDJOGhc3Ep~Id|c+$cj?^tr2=?P_lb77uQB-AgBszPVl-HioSRR9Ye z{g~;A%x(?u0yG>A|A2g`9}Z-gG@Kzfz%!9>zOE5_lo>dBP|&*=`o+$hIS%Q^C9bD6 zxX`U+$3LI9bHK6V!!s^c_8a!2o+osBre_mt^T7<0tNP(>>k+od6wb25Y#G`p^%tl1B@iwJfdXy$2qJ|is1gOvD6?+NhqdN!CLG?F_O!tHhlj9$ zanb89llP}BmOga6>)<(PMb&e{r86duTHvNi-6O1_nv1gj9~t3(dw{7v=NvG8m}qq} zOnvG1pF#jrgOI8Sh9BIgWgT{Is(^>j9&IZS>LlS*@fzJ3{uzbo4ntGXTbhl=yuTqZ zYjptkI_x(%@4oCX}6EEMLA>gto6veU?4t5jlAKR;R=Q1 zx+V|G$t)RcW3t!rf{A8b=dry)2gS$0_dcfD+0c&$+Iu8wD^DQ> zC+E!*iXRJQ6ah-B_4f$L9}8iu`9zN|r6mW=ljp-e@;~mXGq9BkO;pkVInneA48IiS zhzjqidN5uw`W#giYRpTiW@x)8QO7kAQ$w-1F)Pd`A=~0)M_gR~i?-}!3%=pWIln(! zABd4ebA8*YfGd`HoBBltDY3z49fLXwbP&6nLb3b4mI6q7iJ?w9?>?d2*5dLVvJW&c z_AeyR5jk{eAGa2HuE0r*Nx$SDc`&2#);VqXRFb6kci^KZmbfc|$#z|u#Z8=ZLP5RB zH52r&>T70HI^ygwg8=mTnChoBmP}O&Gf^>X-}kLSxWn@~E!(OZ#_}7xQ|EVntuN#K zK2O;+$@AAyO5T(L7PLy~6+2jA0Dj3D)*ebem@({O6!o&|t=(NvVv0(g8xo{a@0OlH zLDbgb3hINE0QU&qGJj9HUgHeGy#aeOQwDSKiHnEWFI^6OzWQ4yz)t|m>czf0h6r0h z2+7l6fe@y+DXs#`-FoS>ibHHVZJ1VTOIkyZv^YXqUpgL8ca z@xazlT%Pu+#L&RZgKcOxyEviSuh~&b zM%I`RuhtcA#VQb zm@LB^Bj^Q4J4wS-mjo5sPDZq@-J?#NXsfZJe8$D=ei2A@2+HN+rsrwX4%(lZciUin)4 zXlGCg)(8VYUT={(z8ei&)L+o#$J^!E?N?M91-pEUx0f5%qP&&3=h8cSIfvVaUBO{0 zw>HR&Grr4&q*Gc8Dqev&#%QgYTk(=Xzy}6BU_|FPOnXmnXN?{W*?xr$SuoFM5BFu2Tm* z$;X9St;5EMstBQ`%(f$-oTQ0uA*wd0R5rrgMV-}oI0Rc#GTIT;@2cVI>N;A{S(Ujt z=b547T3E>w-{kR|tgZ!lRxq|K@kW^_NAqsZ6jgUn?NPb+hU{jJc`mr>h(Vn1WEK*3 ztbb(t7moLjMs7{(QBLz?v9PYKx?|jEKJf=`)TEofecOKa9c)6FzHoU#-)$CFV7N$2 zJtIHcW+rdw*YsnA2ZHB4UI{k=7M;jD>Rkx)i2BYahiOz5j3;S4%By1g3qv94ey#AA z=yD^bITi!ggArWv@#;}SBw7Iy>f#Cd?U-0}9B9vP-ieuF0N z`0Bjf{#*>%kZTQ9nj?NEnUkOkuIiCVD>BqCr7$ap=z2{&`}n77*2#r5YLGK|(@ zDm`oYuW}uXDEm`7sssD&X0n>GdJ2OsGruZO9A$xOj4>lK8ne?;r?gwEd068$poops zW501riIR*;DswYjfqAHNs()pEeE}`s=&^biKiA98LY92O^1&6{WFXBcp}<)qgLcEY z?EB6O2C+UcwV!QXu{GiVW|uGBTQ}|&44!)1n_Oe4Q~LGM7%t>aGZwDX;o;Gz2mGAn zt7lMqH6YN9<0M4%9W7HGF-lNl&JlY1Fv-hTpn0UWpmnm6)^u zl%SWsrjkRT3-cS(^o8u|p!GK-){yXJTqR&@7<+im}YBxd9MmUce3^3?92CG32Xoft}7DJ z)Hskb)JWg!-$)s!n2Bf(SYD0nP%y0VkIU)jE}g$IURv9g_0Y{$4WMw@UiMJ6uPA+u zztW*WEHK0_F;fTm0@jWU)p^!|{FuKI4{dUj;MeC7;)iF%>=Y|rY3zZ_>cZa0i3xUEI-lmzj0e1kqrztOhDx~xa$gi}?h=uW0B2lTBmP)#rxe>2Fv>A;-hT>Lrcu}J6L1s!IhrK^{FE#7(abb_!hLo0tTya^`nJ<#mRO?j814iV@fjYcRXm?_L)aQ*E;l`yQno@?$k z6cXxI(J?&|8@+U8CK8qyE^!{VC)UA^EHP#t z_l^dOYg}v}FSci?YbWb!s3k2d`J zz$#%S-`-bYx<|Wf25=8BRQ>+d4UB7{T*FuGRJsm1l3}|nIsR_?2{2Y(NOP;O;R+0< zo4Q>+!##*#YuK)t$hfyG=Kb!|?H6jemyU;Jzm|dBazGia6Kv8Z>N_ZITpP= z_zJNs^`V0@@tm)boY3fmN)^t^wDk$LV#bS+zwv9*RAeBadV1vL5<}3jM^ac8iWw1F z?fs7B39y-FUdFQE>$^x9DYZ)TaJdN4H96IGfy8hwzo1MxZA?4V|{YHy!BR(h1&-CkvAV^HW6 z0rF1&mka3FGDT8^#E+wIKbu9&{63xJm9GC@7@o@pqndH|V{3J~XDfW-__y45Dj#xo z7}c2-42*LO+uaZTX`k`qe-~fy&#CrLmLXsU0j^>uQ4f`$iUt3cq5(GFyKl%ulUP?P zPS|%p|Jy1ANC;KO2bqu8D)MrQ6qrLp4*S5r;9V=q4EH)(AG^Nei;d=ZlCNOuh4ym7VGaXS-H7V)QdN<)0%TKz9Jexyz0D&x*P3<2V0xLTmNbX`Tm>dMdeZbbD z0pbGm^)?{+B*v#+wz%<7Pl0AqVQWFn99OX|-oaX6&BeJ#<_aPpxiy#L_*ZhC1N&od z?MUUEQFSJ7bhfziHTmb4G+{$Bql96)76@>Y`>(iNR|LDD0>Dj1>FOe|R%PN8s;jXs zKk2W1VF#;@EILk@3cWYqy)B-A9{urF+8yC#VmBi<1>nC9U3t}h5$PRW9YXVi$p%&J z*0=BtX{z+Y`fm=19IZzi_GctkD&rW1IZ!2sa|#qw_g@&Q9R((UdyQa_*3UB2=cK_& zmpXg6kiXy4o~xMrs_RI*W9y`_S&g{pGwmQRnB6Zw)0Q0=BKlR{JgTu#G@7j&Id{vc z)+f{dg8#fX(irm$&qQDPEt`qPke&c*lO^d;UF#P0>YBZSj>zyttN3k!im1a9z4wy- zLh>_w#nY|E?tqrBrMej#MHpcpMnB&ES9uLR+*mAl>LO}c52O{5yn>jSLV{U!mtMEa z4pzw_1I(>4TcE(~@dW7fS4bf9qS!WLu_mz&yCDb3b_@@7at{SE!cGj6|<;q+{g_CSHt23$v?k6Qj8$M%(wgrLI0-%2JMKkLqtM6_% z`E%4tD}~JX5c4Fo83DX7N~ifDhv&y2wtAfk3JT>6nO%mT{KA=OjuDK452RreqZDJw zPS#+3$!`60)v0p6VnYkIDV2;j?C^?Y1`G5|7u}zvf|$M zBY)npV0SaNL!nfr-5}R1bup~pTEiOP&vYNv{hZccp6o(8;;2Vvk+LDC6(uEs#OY77 z{e~eMIefnk5eP?L2ipuvos4AyXXjLrcga!~y@ z(wXEdX-1uf{p2FNHTy}K1tQshGA{Z1uPvmP=8A99C z+eiXZ&M5ukAZ(jZ=U}y6iP$ey>aP@ma*EZ-h+)tUQ1yQ8#X0XxD z$5I+=v}k&)`-Wh=w<>tjd59mrZ#ygVbs-WYpse z>TOpO4rJbf%DDO`mZU!}$~~~Jl(eEfdADRqbybd)aXHi*g1ew|>$B^@U}%NhyFNin zxk+7=*TnlT?n{SE#LwFo{L0ePqr{qeulk=acxJ?!9(u*pG_{+mi%{5srs1{M9n zxR~3l-=gaw51OWkzZZ_*T!|ju`7cK|tL;&XQL_P=hus^nmY$@nG$0W1ut%=%RChd$ z=9_f=asty-?z-@rl6EZueH$>vMVeOlZU~D??4!`_a+@M%s?@S%J3N){9q4-BVPm z>%LkW=$Wc8X6et@SU_^%s3gXzO$*zD{L5IG#74vSZWyj}w=9eNV~F19M1;G-Qm-F3 zU#3o5UWU6lhdnnDPlUoHg8s71(bfb-JsG0Y6)0z*f>g1k(Bhi?*JI$ENnnQA7!$Nf zhO&qaO0zp_s?5I_5#(83eezv+Lj$he&OSpYB`Gxa-FE>Smm{pBj5PVRn7X7|NIC@50zZb8V>tn^Qq-p+v2!N_AE-knP2scDJ5EN4 zmag|*!1z*$e)=>}V|jZ479)6-)snpDPC>Q(_c59pd6PmkWzv+4(~Mh+lK^RQpC>m^ zgTB>7gxo0k1r`ronfaPLVzxQ0?V( zhpW$5st~_#`j_wHfMp!FrMewM%pO@v+U}l#hn`5e5LM^oOxe;g9Yo?$c?Sj}pOS4fji6s}37P4I+&igGH2DSF|wnZVli0sL*%0K%>&z?~mrGNMC5EPRM^!aTQM zU=Bo9`TA!=hDs*O3D6(@E{~C8-IN4EYcxMvq3*Q^OVxVq(E zN(SbY^_Q#>PpvKS;-E`;rz?=vU{BxQ(%D5yUnddQPN(=czFgAUzL1vQ1?SW)^QA)3 z(cqICmyC*lc9u%1P%pgGFiIcQAdhHj5Nh42bqAVCT5pECTV^9ApRA4EQ4b7-d1OGE z=H@1$xT^W5@BR{79T5sH9weXF`4&n6mR(>`hqioZm%g#^K+^%3;4Q7{H(1L2uqcP; z=Zo=g;?EX(g-0;v@+>BjJ9-@5n@kn(Z5B{?L8_dbCH(aO+9D(zeCctm=_T#vo9l2p zyCeNx8=zuc`(hrQI*0mu90H+XoYv6=gb0E5Vn0N#pLhz!9(i11%InMv8;WAF4O$0p z1T|c4&?DKyeN+2dIsYFoc@#U(UUVpYz2Q^_9bq|nor(N@62>|P~6AAV*}h!i>-z3WjQ z`UTU688TW37nY~sHv^+Xa7C|8z;uexdquio_h{G!6xfWJjs*fYNNqL?+9J>%J9%!; zx1k9{r1pi50GYtwRSiOK=&%}lOVafY%5mY(A8@LN<^qj>#k7A{SN3Hm-xlrqd!9&d zBKCgSLq8SPFg4stlX7xn+J6jlwaNAmO!3y_T{V{hAd zFe>YfBY-3EVe`j^3<>vB`{y)ovAdpmBPq&X^zjz24p|KGbJaW=WJQ2>-k0rZSr0E^ATz%- zGt=ly5K?AU&~WPK%vhLjZTR_u!+cX8S>rvlZ$J-VwpGC!nIQ25<__&L{-E6tT{j1k zCpYCU9FIe~9_t^B3ih(+v0dQsSNcQzO>#$xRM79+w*Hl;0OxX$w0r}{*2Iml5l?)X z#ZKJzY35N5<3v09O|Fxg@2W1H%Vh(s&L31G53ao0Z~@@kZ9!Y`gkR%`b;IrBt7{Zf zi!JNg-Szs23_blT;393B^Vbhlw{DZGYO*Ki&aHg#t>p=z#Bh%DZFEbi?cb*8f16?9 zO3B6TK=0_5vq6~v1Kdkj7k=EX`E+1Q^NtT5N^)2ra;Xf{Dr#5R;pF0K7wr<*5ZS22 z3i8xx<&U0=L~Jzn`;6|7l3|7`D@t`tK)vRgwpI(*ap^^VdLUh~?|B>!pE|uq|Hx+|9&8bn?DlsYzsg0zLAOm;LFav!p_CXUM18g|*+P?eXik)*I3 z$OHukXJwyc29}Z4$ZH_Xl7UgVjP|xT1{j&m^le#vsof zMWR#vXvG`m9b+XP;lH?~i=dmpFkN@o`V(JVGRVxvT+cxD_H_ngb~%dAI8ZQTTBJiJ zM{59Y8ML4HWdxd%EH<&k|7IB$y2;T#>%oMjwmhRn%fJpZJn6DOM5bR^49<{LzZ^Ds z`oj#8q821!ZKhUaylfA*EgxF*JYPV~9gz?twEFZWxpt=m`v3#=Jx*@uOU{(jfv0&- zKAoh5G`Wz&&n^pH2Qbw{PrtuG5`z|1#ZK*R?t zhk3WIZH$s+;rn+4aHqjP?9X_x!PT5@Vm4W`f75T^Yn&ao@Ps@k;~0sl9??$+6JTvR zq}FW5aBAJz?-Qjg;2T9_;Us!^@+ki2TZt#ps&T^QQ2h&ZNuEJCp2liYHgoapeB#GR zcEWfv?XxtB_x1uh`kUd$MeObIUL6q3)tPvPPj9RR=6=YNg3v(stkuSGtB;UsvinC& z>%tUI2-Q3;1m%QnP(B1Q|7s?lfi$FlVrA>Pp$}WPh<{5M`#HdB&S*^+H&S^W3XDs< z!|LP0jzg8gOs}z)_hNkP|1xlUAJ=->>qSO}S1kYb-j7U*Tvc$;@l}2#;AE&^=WKj* zk<(L8&EsnfZM$OP6F=R|}wMdL+aCCYcrFc-jac z$RVP{!J?VjFe6qpp4K5$ok&{@JqyUCPtMuR?SzcN_jqO*cMe}N-Quiw>?L4_d&2wl zb3n8Ie1EOQd7DcmXeeC@elY|rkRDdj@8K2#Ffs#M>Wi+_)QX5VVuXzgY~By`s&oAE za5UG(Ez#I*(0jwd=r!NFqFHA0thP|)NcZv8745L0Np6!UavBY-KydNwVMv7k_l@8; zXjNSQazGpA;MOdXJL7NAO3Vb@KLN{=RKmG5R`e4u&et>)!Kr&Jmfy4Blde*kP#b#@ zmicqGYu2$1+BG>(PM33o_HT0F@6s+kbTr*`L%o~$BKIh}wE!@oJ-Uv%jW0rlUv!wH zC`W0nDhT)vW-=t~s^<=DZ>Mv!6~((&^^b_7qlHoNWm^FL{cBkKsL*UOd|&IZ2}8V` zDoob{v1o3DcGcXyln=bIToa1b(bm(>=9t9`K)E^mySE_y=4Fk#VGTg!K`fkl90&T< zI@jHQaiQ9?>*3ABxM~$5FWX@WTcFkr83*oMPPd)OxC+*b(yFKzF^z% z-o>8kBe1;9gKduZaW7$Ektq|uEnGyoRqqP|e3$cc*B@`Zv|Jp0w+OgiI!23v)}J=B z*-}D?!bW7f;2Q0F^0evzLqy-rXFdD?_$BPk3G8S=NWr+|jCl12S=I(M9c_R$rv((< zzAEZ2rviR%RDE!m6c=s-b!rN+`BJ zpgE)!LcY)jqYN?!Ghk}uxB`>MgR=H_6no+A#mlSzGIx9ajrqg*68n)l-@V(+wu=OG zZIO6=#(83qYPkeqeEmV=OP>s?p2i-8!Sx5JBbSiMWtxux7XcwOuhHgCDf!$^rxsn`h+- zM=ktAcDcLY9@!Xl)9SbUjdKDR@X}o~<6x1sAz52pPiMz-z|JZ`ji%25vlCi`-@7Q7 z3IFgO+P4aal%wJxtSo!Mb?brY$+3#7s9C2uvV)$*s0)GX!Y)>p*BSxUtS;vU6%o}3 za2A>;RQ}Mu=g$~K$|;I97-!-bA!|p=Vun)CX7#T+oDv(k6t2g|kz+&k#ZN42UZ^-A zTSv|O@5cFwXP;g->6d5Gp-#2Yx4xBAf$NyKu1m<$0@q(pPV=YEr28X+HymuO2_lu> z1%VhYiTD;QrVtDD;oUpYT>(V}K~Yi4dosVZXjqxyqWI@-+VFf_f&bhLB;z)~d*6E+ zM05d{G^;gD>f)$#KV1w5m;73ntl33k6$1cRF{9V8MfdP%<^7Rm8z*2ueAw3v?`_EO z^Qz!Mnxd>6{H*KtTYi3{8SugJ+r2hABTED4jon9`Ph;JXrSqaRbo(b`R);ZYJhF@Z z@FFsWu~v0${btA6p||%ibqCL2Bi_ z$x18-JPJmk_mgJjSUEX4qlFi-yVzB+tk>jsoZjKah708S`jcT}K2Cq;>R$-JdboaY zkja^oVdmB%_745fW-3s&aL-FyL4ZD!}U3qVEUC3ZHtn=Uol95Z%sXIe1loi_ErB9UB~p z`DJnZ9-W_(*N39q$-pUG!nYR?OWkza?lhn^a}-AHhWH=T1S7aFk@(6ta{y!9ED2)} zu^Uouz8``%-;bV{G6$Fe$p08+IcBkus|U40<1;^m!F|#{@5BJtr!bDGV4Q#x&jP_? zyIyBHp~C#$UGNVw6E{fu3zSoe4GkbzAcWN8F6}bk-G2VGS>#KR>B#gR9O>*WcOcAI z$K{NB8kc5yOsC5(waR}W^VmN5KxJxG2<|%WAfdJnx<)mF_J(irf{A1!H*9172HxO{ zQmsoKKy60tq#)eHVfQS8VivP_I%I)3Z*h2KG86)XMQ76I@g3rpHpdLbq&t>Ekdb@4 zn|!@TF0!)TjeMoi(XGsjXS($AzoxMY3Jf|hT?rZeU<4`4D{A87VgAcTQHI_ny=ptX zn#e~gHl3MN&!0I=ooB!~cotu7RcXB-v3q7_D~f+=#u`6p0Iwo;EZ_VOhj+sf-tMJ8 zI#-{y&TRq#e=V)E>$22kmyq?RQod&AKMNxBm?NM@mg;<2qwjoU)@T&{|p)&ndtE4HMc7; z|BG#U1CGPKmB}P0l!XBQV$grFZkOJ$QMKVb{6u z;fMO}E|1>hFM&EkxHE;>SgzdBZxGV)^w%Q5yK#nL%O8U{xcRXI>q^lD#xmlTAFO48 z?foU$c22$fAr1z_@i(qjd5kNc z7Pw`8>2nT?q4e)NcR9ZIOcd9Gn(M;cj(KaL+XKXYIx)U#|aMQ@V}>7>lTZu{yRp!qIK6;~*^N-KZmjF)Bp%6c8D zR+0T=YWL{mg-EMWT-;2Xxek3>!=ju9JA$#cdErpk+Vs&VG z_@4ZbZ#y(ln^JJ5c>K|+#bY{wZv4?%-i{tHH-nM&{{t^uC^R6-75OCVSkn)JZNWJs zUqc<;OPBJGmBF**X5>vdA$p&!z*JTxXe`c-XCVnu(BYl(H4(UfWp5kp*}u5*$^VQ; z{y$-^{RbA9^xT#Icg~ggM@h)`>u>}Dgu85j*!?j5)Cbv@xjzkm3m~Nd=eyvGoEPGY z3tnPXUc3hxZK@uZW%gCk@`v-^O0_`R(Nwo^s_sx-)ug+qrPc=6?jrY7K!cI3+fGjW z*m+g*cF%Jn-=vvuv|+n-g26-5X$@O_F6r=G%gaV7k-3q43~3%^~`P!o8%0 zZ-rDqhS@0ibi&9xC=Q8jI8AV%`7ldMvqrpuzoi;GJ*YFXQio?=^m_^ox$wnW$`ok* z>&Dwz>gLW^F!_p$4n(sgLr=EP$td!bl96PRW_zg{IApwHrwsrGijQaeBR^dR&X0J! zeN3(RN5h09!Z!(x?aSf$89_Kx!@sv9gXNQf?i|ntqwu7TOjvDu?E_iSOgCMgwK)53 z%g`@(&M$d@rCuJVY_oN<)!x9ra&qqK%JVFt1UaPj%nwW))6&kMT~5`%nirp$U2r}8 zUd>|f(e)$5#EB$nrW`T$S&{c8c@5$4{3SgSkmX$SlQAr8d<$^oTu?7-RXgHp&KGjdvlKJ=2e~6KdP7llB;fC41&a8xRUnF1Px?H!x!|3Da86O zDz#xKw*(NTFQ?UMJAillnHo4XLV`^1kNlll=vFCAijd&<`EjVihdmLz%>8By7YO{Q zo8loWuhgdSt3~!mnTYF&H7-O%!}BwAO82lrcf5LuDW*YCLk8Hnxt9Pl$m=jKIs7i5 z0Ak>oTq^0i5Nxx`=G?V!uLZ0IY-gE{I=XL~UVn9aX6Yn)$dz({l7LEL?M!e^Y)YqA z%q%v)F}~56cMnxVM(7pL4JxwV$`F=EEbm0i0wb9$jQzSs?CEulneT>8^qU5q>Pz1nShrkJ zsln7@b9#OZKtL;oBibOJs?<4w8Z$Ama}Z<(h}jVN$SH5VkLvz^*v+A>1`eJ^m#63u z2yU@%pxpVa1?UY@)Q}<6;+-u(&GYy+Y=IKVIBhd8m_$H+=ouVUP_+g^1^h~6u>^KR zsRMP}zmz5aWElN_Ng?#-JN<7zA;9Qg2+nglW6w#eF$MunhGX1sCHA#iWTB!@2HZD? z=S;c8_LjUl)i;9(4@v|a&VsSQVR%7(`Q&buV|&`ajVoX&RG=IiDd{tBZ`K+f?Jq|p zS4D5;<+k=*X%>NLPWzg2oOK{34W||+YA1PfgX^RV+FwHo__#qe>eePcuoP#+Wi9Mq z?3>MWssDVc^oUFcRhS(CkUodLO%Y(`OG7Yo8o$`(CCknT(ckK@5Y&1}W3dWvhjQ!P zjgzTvuNK7fWMulB3q(V7Fk7Jrk#B1eYXMm6n%ed7WApPrP&qbId1EY51>j8;eG?Mx z{|o#C&Kw|-CV32!avPSboUB~zb2DQRGxijTc}D7(Yw4-Xo~dqYvLqWe2`430k^ZIr zCaTP4fap771BJg1@##8n&DB!BAZYYfouN*Ex+U*m|0cNkN+1dFHKagHcTGGGAF^`< zS2_a{v37{dkhnlJ_air9h^gJrQ|7*yniQ%4c;Dl6QnY5Q8u_8YN}Ed&713<@`jK2Z zeb3?%L`;OcTY1Fuk~8Z_H0?w@ONZRVzg1$mm?0M|o)K@o2=K2S8)DwosGRIc-UA>- zgFZoAewoT?B+IKAI?JC>vAv6WuIl3g1D`Jd>ICKh;s}3OYwmQDohWeMmRVr{_kR>V z{HVy29nQ&tC5)JA+i)y>^%6E=m1hL`3o5r+QK5wO?fsXE<7r(Pp??h~H8N$3QYzLr zM|T1*YXq6n7Jbfh4Wz$Tw5@t}Lbg_EW*4ria6r9tQ93fL0UWgKk0;I8!ysoJ-^tf~ zphHEm0~Tt~MW3!LG6$aNc_k)M!R5L_K_g~Jtbm7d9C^5V|YM-$wFn$N~h{HR~xiE)${H7a|xoe++j1*2A8h zp9X?mJkE8q`ert0DHEqR$Lo61%|uPyipp4i6QRywCuk6e>{{%QVoOlz6RY$$qn!}& ziL%o>8pEJU3yrs7h39X&_z(E1UTwkR%xUfjs8TQ=S6rOo@X=7EnZ~DihV#e;Xg5H-NbkOu$k!p8-hdYlQzMXXcCz}s zf6Srz5zefTUY6nesL!#cyz<~; zQVPoX$m?oq?ZGWryIl&=FSEZwNd-47)CHLo&xc43R2U26Zq=PLz2KS=#9hs)WMNfQ z=qgtpiLbdOvcwE5WYjx<Q~a5s*-W>%{x8PiJ0SI2Q1+uB$Ueqwd@Qb+c5|`L``XmSqg2tdJVzc7s}_w9L(l z1c^GJ@D3ap2^q1p>CEsI?~D|081w(O@&MWZQVXMQr`gL`K7vM9Bl#{clwH%47N@?t zzLGNOKW8jI|lKD!+GD# z6w3E^6x0Ls6Vjy9fys|+6OK7vI$z*#{4ivtkEM1UqJ;E&yqx%$kqK#Xp#~|P_oUo=FXH4!0F_`bq)Ms0qi@;tl@^ieKVWGh z@s^H|{+f0tZ=ia`t!;PW9%!mCJ?L2Gow_QqGi9wvvnv?_&rt&|W73rqJkhxIvCxXpHz{0lN%{LZ@*VwwzFQX`_}zSr#&_=pm)15d+$62?+7xQtcbLc? zVeoj@z1KC^-FCK2tJmv}XP8E#)vcu%N0=MHZqa{ZTGJKcXRm}~y-Uy|b5ogKt--B; z74UDJJ>DPC&(6grqpfttwvE$)`a_ouj6NJ#tf@1TL&*jBCr=~ z0_t@&^t2l$O0kbE$gxw#Q3-{^y7ICC+C{D40a+e;T! zQDLV%$UNlZ(KFu^{6O73!sZkvLiq4BZ^$oOWw9$Kjh8k+VNOQ}`JM5b813Z$F-%3S z_3M1mN1Otl$KR`LN9i2aq`BsBfJBjArkwO^ryZH9#Vesl(3@~s-oHZn#jSM-XX`b=OqmY=v4I`?zc`JaJG5nh&L`-eRZI6ZeW34h9kH!V^ zp;s%jxQ}3y*f7B5;U}5j-JHcO`mwN~P}8Ff>OnGzKUbl5Xh4=_-RZ=@0vo3H=6X3! z^tFcj^Up5b%y=@f7H$xcL|V|@hPW2m*h|!2gg+i zM{CVcb?>Yev*wxpwawT_xANbu-Ohdn_Ta2XY%4Nd*x2`ydxA$O0t}1NSv7@l#4KU` zXw6?_7eL%*HW8i1%Y9%2<@XopdBF3?A=DPURp1QUo2d+T-3QcqZnD{%6hg!an;to( zW+$dp68k+K-E{;P;p!W8ueQLkKpE~ltiq$+2X$5%j3A(^k3yOh7@0Tx8u~}H6}Mgd zPz2bZu@2;dGka~d2Ht8H&?*Jq@4B39rA|UEpl}>~H-6OWRx{W+JGETnn4**c6B-e9}zRp%>@zj&FJ64QdTR zvj6TC3|gW$8?N`Ky8FA~yxq<4iUIgjry2d4+1eDhSS2n#+reGaS}w&Rhaxw&|1k z``n*C((cXt1oP59deME;nT=sD!hTzOKJffg`@nNL8>1)o)D2p$J`MV^ZqKS~I|KF= zJUe~bV(XVPDI9&n;>|(KWy7G(W0Bx0}iP>}AFe7;h!nt`EY1zIMbJYAoE?AOs+;;wvWxFKB zKCbluruOg4Nhi&}+wR{3<=?a7-z&<$mrv4L|6evGEEMGA z^iXw+nGy`6mvxmSkJi*lR9Z~%iwHCzNIn#VerZk!eqRT6d!(?~XdH%=HtDu&z}qX- z-AhE6Yr8cX&K+^@LqhdX+&%-aGgW^h`_){ZW!&>t=}Fj!eg?K>EY!Q=f#vb#0%U{I-O>_bX>k95NvIio&OonKlG+bK(uao_NVQkxdS=N;oVITO=oXI^nl75#lQIr#bj zj{~D9xM>3sGF%)#q#V^!3}O7S@16!tXbLqX6AT(VBPro$7g`JW(D`@tS37u#6YV57IE!6kcG#wXUY&Lg&RwfFnN?&+`n|e2I;o^(JMQUt0 z!Zn@}hMMo?&>Mel@{dBK^m_Mm_(IixeWl4aaPI5Rk3UBoK!y3Lg}vz?G8fUFP!NV> zEkRyg<4Xy( zo#h7z=7t!meC4-e*>8m8kl`3E?cwh_44X|kpCJ*l5SDSJaC-gJ=;WxL17jL({<|`% z36|Sro+%wZ--aVK$5)XYP9sj;@8k?@kR2cf#a_=;UV&y+{Q58yc6tf>Ku+*evx`i33Zj!1tmNi3iKReie2r_pl>Jz2<*Us)<}fE}~p zkdHWk9%tD)(?VUyZ5ddQwBssojirS$c=-No4U*7w2LDm`rTt^*+zAepuvk#vGc>uL zF;9I4ZcgI_x|j)WEykT+zsR`WsSNtPpvG;wA#N%VMoC{3e{K}r?E*&GPWE%**FMeC zI=|+JV8l=63#6E-zM4cvTO3C zGx?i4qW;YN@$pgAnsxlIKBlgT+b_uOSAS>!`k!}an(Sh~/dev/null) + printf '{"IntuneAgentInstalled":"true","IntuneAgentVersion":"%s"}\n' "$version" +else + printf '{"IntuneAgentInstalled":"false","IntuneAgentVersion":"not installed"}\n' +fi diff --git a/generated-baselines/800-171_macos_26.0/README.md b/generated-baselines/800-171_macos_26.0/README.md new file mode 100644 index 00000000..8b4e9303 --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/README.md @@ -0,0 +1,21 @@ +# 800-171_macos_26.0 + +macOS 26.0: Security Configuration - 800-171 + +This guide describes the actions to take when securing a macOS 26.0 system against the 800-171 security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **54** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **145** +- Unsupported rules skipped: **33** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/800-171_macos_26.0/manifest.json b/generated-baselines/800-171_macos_26.0/manifest.json new file mode 100644 index 00000000..3962107e --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "800-171_macos_26.0", + "title": "macOS 26.0: Security Configuration - 800-171", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the 800-171 security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 145, + "unsupportedRuleCount": 33, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/800-171_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 54, + "path": "generated-baselines/800-171_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/800-171_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-01-root/discovery.sh b/generated-baselines/800-171_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..de184934 --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1115 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_failure_halt +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_enforce +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_filevault_autologin_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_nfsd_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_proximity_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_root_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_sip_enable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-171_macos_26.0/part-01-root/manifest.json b/generated-baselines/800-171_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..caad77af --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "800-171_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_burn_support_disable", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_erase_content_and_settings_disable", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-01-root/rules.json b/generated-baselines/800-171_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..dbd886bb --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-02-root/discovery.sh b/generated-baselines/800-171_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..ecd3e4db --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,786 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_time_server_enabled +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_writing_tools_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_siri_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-171_macos_26.0/part-02-root/manifest.json b/generated-baselines/800-171_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..f347ff0f --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,62 @@ +{ + "baseline": "800-171_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 54, + "settingNames": [ + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_content_caching_disable", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_rae_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_siri_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-02-root/rules.json b/generated-baselines/800-171_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..bb9b6e40 --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-02-root/rules.json @@ -0,0 +1,760 @@ +{ + "Rules": [ + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-03-user/discovery.sh b/generated-baselines/800-171_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-171_macos_26.0/part-03-user/manifest.json b/generated-baselines/800-171_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..78168731 --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "800-171_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/part-03-user/rules.json b/generated-baselines/800-171_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-171_macos_26.0/unsupported-rules.json b/generated-baselines/800-171_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..a312efd1 --- /dev/null +++ b/generated-baselines/800-171_macos_26.0/unsupported-rules.json @@ -0,0 +1,200 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_privilege", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_privilege.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "pwpolicy_50_percent", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_50_percent.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/README.md b/generated-baselines/800-53r5_high_macos_26.0/README.md new file mode 100644 index 00000000..9708649b --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/README.md @@ -0,0 +1,21 @@ +# 800-53r5_high_macos_26.0 + +macOS 26.0: Security Configuration - 800-53r5_high + +This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_high security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **79** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **170** +- Unsupported rules skipped: **53** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/800-53r5_high_macos_26.0/manifest.json b/generated-baselines/800-53r5_high_macos_26.0/manifest.json new file mode 100644 index 00000000..dcf78e87 --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "800-53r5_high_macos_26.0", + "title": "macOS 26.0: Security Configuration - 800-53r5_high", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_high security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 170, + "unsupportedRuleCount": 53, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/800-53r5_high_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 79, + "path": "generated-baselines/800-53r5_high_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/800-53r5_high_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-01-root/discovery.sh b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..46b8be86 --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1103 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_failure_halt +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_certificate_authority_trust +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_filevault_authorized_users +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/fdesetup list | /usr/bin/awk -F',' '{print $1}' +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_authorized_users" "$normalized_output" + +# os_filevault_autologin_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_proximity_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_recovery_lock_enable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_root_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_allow_javascript_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Safari')\ +.objectForKey('allowJavaScript').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_allow_javascript_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_secure_boot_verify +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-01-root/manifest.json b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..d7d84e1d --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "800-53r5_high_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_external_storage_access_defined", + "os_filevault_authorized_users", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_recovery_lock_enable", + "os_root_disable", + "os_safari_allow_javascript_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-01-root/rules.json b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..15bc195e --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_authorized_users", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing authorized users that can unlock FileVault", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_authorized_users.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "FileVault Authorized Users. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_allow_javascript_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_allow_javascript_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable JavaScript in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-02-root/discovery.sh b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..6b2684fc --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1067 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_siri_prompt_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_time_server_enabled +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_writing_tools_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-02-root/manifest.json b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..4d014ebd --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,87 @@ +{ + "baseline": "800-53r5_high_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 79, + "settingNames": [ + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_per_source_penalties_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-02-root/rules.json b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..072aa01e --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1110 @@ +{ + "Rules": [ + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-03-user/discovery.sh b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-03-user/manifest.json b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..12c4f8e0 --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "800-53r5_high_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/part-03-user/rules.json b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_high_macos_26.0/unsupported-rules.json b/generated-baselines/800-53r5_high_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..7629c9b9 --- /dev/null +++ b/generated-baselines/800-53r5_high_macos_26.0/unsupported-rules.json @@ -0,0 +1,320 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_crypto_audit", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_crypto_audit.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_enforce_access_restrictions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_enforce_access_restrictions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_fail_secure_state", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_fail_secure_state.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_memory_protection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_memory_protection.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_isolate_security_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_isolate_security_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_limit_gui_sessions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_limit_gui_sessions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_emergency_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_emergency_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_temporary_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_temporary_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_non_repudiation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_non_repudiation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/README.md b/generated-baselines/800-53r5_low_macos_26.0/README.md new file mode 100644 index 00000000..bd96e045 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/README.md @@ -0,0 +1,21 @@ +# 800-53r5_low_macos_26.0 + +macOS 26.0: Security Configuration - 800-53r5_low + +This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_low security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **47** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **138** +- Unsupported rules skipped: **30** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/800-53r5_low_macos_26.0/manifest.json b/generated-baselines/800-53r5_low_macos_26.0/manifest.json new file mode 100644 index 00000000..27626b06 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "800-53r5_low_macos_26.0", + "title": "macOS 26.0: Security Configuration - 800-53r5_low", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_low security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 138, + "unsupportedRuleCount": 30, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/800-53r5_low_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 47, + "path": "generated-baselines/800-53r5_low_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/800-53r5_low_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-01-root/discovery.sh b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..04f1b66d --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1124 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_failure_halt +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_config_data_install_enforce +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_filevault_autologin_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_gatekeeper_enable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_httpd_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_nfsd_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_proximity_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_root_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_allow_javascript_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Safari')\ +.objectForKey('allowJavaScript').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_allow_javascript_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_sip_enable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_fips_compliant +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_time_server_enabled +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_writing_tools_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-01-root/manifest.json b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..13bcd446 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "800-53r5_low_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_external_storage_access_defined", + "os_filevault_autologin_disable", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_root_disable", + "os_safari_allow_javascript_disable", + "os_safari_reader_summary_disable", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_fips_compliant", + "os_sshd_per_source_penalties_configure", + "os_sudoers_timestamp_type_configure", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_writing_tools_disable", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-01-root/rules.json b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..0a671e8a --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_allow_javascript_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_allow_javascript_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable JavaScript in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-02-root/discovery.sh b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..cd39c71d --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,666 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# pwpolicy_max_lifetime_enforce +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_biometric_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_find_my_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_time_server_configure +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-02-root/manifest.json b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..1d828782 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,55 @@ +{ + "baseline": "800-53r5_low_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 47, + "settingNames": [ + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_automatic_login_disable", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-02-root/rules.json b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..7d73c2a6 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-02-root/rules.json @@ -0,0 +1,662 @@ +{ + "Rules": [ + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-03-user/discovery.sh b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-03-user/manifest.json b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..879f40a2 --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "800-53r5_low_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/part-03-user/rules.json b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_low_macos_26.0/unsupported-rules.json b/generated-baselines/800-53r5_low_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..680ae5ab --- /dev/null +++ b/generated-baselines/800-53r5_low_macos_26.0/unsupported-rules.json @@ -0,0 +1,182 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/README.md b/generated-baselines/800-53r5_moderate_macos_26.0/README.md new file mode 100644 index 00000000..17e2cd90 --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/README.md @@ -0,0 +1,21 @@ +# 800-53r5_moderate_macos_26.0 + +macOS 26.0: Security Configuration - 800-53r5_moderate + +This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_moderate security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **76** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **167** +- Unsupported rules skipped: **47** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/manifest.json b/generated-baselines/800-53r5_moderate_macos_26.0/manifest.json new file mode 100644 index 00000000..3007b3ba --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "800-53r5_moderate_macos_26.0", + "title": "macOS 26.0: Security Configuration - 800-53r5_moderate", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the 800-53r5_moderate security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 167, + "unsupportedRuleCount": 47, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/800-53r5_moderate_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 76, + "path": "generated-baselines/800-53r5_moderate_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/800-53r5_moderate_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/discovery.sh b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..a146e20d --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1109 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_failure_halt +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_certificate_authority_trust +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_filevault_autologin_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_proximity_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_recovery_lock_enable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_root_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_allow_javascript_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Safari')\ +.objectForKey('allowJavaScript').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_allow_javascript_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_secure_boot_verify +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/manifest.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..7b8a0a2a --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "800-53r5_moderate_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_external_storage_access_defined", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_recovery_lock_enable", + "os_root_disable", + "os_safari_allow_javascript_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/rules.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..73ac7122 --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_allow_javascript_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_allow_javascript_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable JavaScript in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/discovery.sh b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..3a613fe2 --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1031 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_skip_unlock_with_watch_enable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_time_server_enabled +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_writing_tools_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/manifest.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..514c5046 --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,84 @@ +{ + "baseline": "800-53r5_moderate_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 76, + "settingNames": [ + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_per_source_penalties_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/rules.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..9b539a8f --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1068 @@ +{ + "Rules": [ + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/discovery.sh b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/manifest.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..1511078e --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "800-53r5_moderate_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/rules.json b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/800-53r5_moderate_macos_26.0/unsupported-rules.json b/generated-baselines/800-53r5_moderate_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..5ca6f705 --- /dev/null +++ b/generated-baselines/800-53r5_moderate_macos_26.0/unsupported-rules.json @@ -0,0 +1,284 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_memory_protection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_memory_protection.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_emergency_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_emergency_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_temporary_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_temporary_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/README.md b/generated-baselines/all_rules_macos_26.0/README.md new file mode 100644 index 00000000..2ab872c4 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/README.md @@ -0,0 +1,22 @@ +# all_rules_macos_26.0 + +macOS 26.0: Security Configuration - all_rules + +This guide describes the actions to take when securing a macOS 26.0 system against the all_rules security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **90** +- `part-03-root` - context: **root**, rules: **59** +- `part-04-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **241** +- Unsupported rules skipped: **92** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/all_rules_macos_26.0/manifest.json b/generated-baselines/all_rules_macos_26.0/manifest.json new file mode 100644 index 00000000..fb25329d --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/manifest.json @@ -0,0 +1,34 @@ +{ + "baseline": "all_rules_macos_26.0", + "title": "macOS 26.0: Security Configuration - all_rules", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the all_rules security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 241, + "unsupportedRuleCount": 92, + "partCount": 4, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/all_rules_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/all_rules_macos_26.0/part-02-root" + }, + { + "name": "part-03-root", + "context": "root", + "ruleCount": 59, + "path": "generated-baselines/all_rules_macos_26.0/part-03-root" + }, + { + "name": "part-04-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/all_rules_macos_26.0/part-04-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-01-root/discovery.sh b/generated-baselines/all_rules_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..491cb157 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1153 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_control_acls_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_failure_halt +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_anti_virus_installed +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_appleid_prompt_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_blank_bluray_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankbd"] +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_bluray_disable" "$normalized_output" + +# os_blank_cd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankcd"] +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_cd_disable" "$normalized_output" + +# os_blank_dvd_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankdvd"] +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_dvd_disable" "$normalized_output" + +# os_bluray_read_only_enforce +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["bd"] +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bluray_read_only_enforce" "$normalized_output" + +# os_bonjour_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_calendar_app_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_calendar_app_disable" "$normalized_output" + +# os_camera_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCamera').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_camera_disable" "$normalized_output" + +# os_cd_read_only_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["cd"] +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_cd_read_only_enforce" "$normalized_output" + +# os_certificate_authority_trust +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_directory_services_configured +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/dscl localhost -list . | /usr/bin/grep -qvE '(Contact|Search|Local|^$)'; /bin/echo $? +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_directory_services_configured" "$normalized_output" + +# os_disk_image_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["disk-image"] +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_disk_image_disable" "$normalized_output" + +# os_dvdram_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["dvdram"] +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dvdram_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_external_apfs_hfs_volumes_encrypted +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No") { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted external volumes: $fail" +fi +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_apfs_hfs_volumes_encrypted" "$normalized_output" + +# os_external_storage_access_defined +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_facetime_app_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_filevault_authorized_users +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/fdesetup list | /usr/bin/awk -F',' '{print $1}' +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_authorized_users" "$normalized_output" + +# os_filevault_autologin_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_guest_folder_removed +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/bin/ls /Users/ | /usr/bin/grep -c "Guest" +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_guest_folder_removed" "$normalized_output" + +# os_handoff_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_hibernate_mode_destroyfvkeyonstandby_enable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DestroyFVKeyOnStandby').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_hibernate_mode_destroyfvkeyonstandby_enable" "$normalized_output" + +# os_hibernate_mode_intel_enable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +error_count=0 +if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -Ei "MacBook|Mac[0-9]"; then + hibernateMode=$(/usr/bin/pmset -b -g | /usr/bin/grep hibernatemode 2>&1 | /usr/bin/awk '{print $2}') + hibernateStandbyLowValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelaylow 2>&1 | /usr/bin/awk '{print $2}') + hibernateStandbyHighValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelayhigh 2>&1 | /usr/bin/awk '{print $2}') + hibernateStandbyThreshValue=$(/usr/bin/pmset -g | /usr/bin/grep highstandbythreshold 2>&1 | /usr/bin/awk '{print $2}') + + if [[ "$hibernateStandbyLowValue" == "" ]] || [[ "$hibernateStandbyLowValue" -gt 900 ]]; then + ((error_count++)) + fi + if [[ "$hibernateStandbyHighValue" == "" ]] || [[ "$hibernateStandbyHighValue" -gt 900 ]]; then + ((error_count++)) + fi + if [[ "$hibernateStandbyThreshValue" == "" ]] || [[ "$hibernateStandbyThreshValue" -lt 90 ]]; then + ((error_count++)) + fi + if [[ "$hibernateMode" == "" ]] || [[ "$hibernateMode" != 25 ]]; then + ((error_count++)) + fi +fi +echo "$error_count" +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_hibernate_mode_intel_enable" "$normalized_output" + +# os_home_folders_secure +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_internal_apfs_volumes_encrypted +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted internal user APFS volumes: $fail" +fi +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_internal_apfs_volumes_encrypted" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/all_rules_macos_26.0/part-01-root/manifest.json b/generated-baselines/all_rules_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..af2f740d --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "all_rules_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_anti_virus_installed", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_blank_bluray_disable", + "os_blank_cd_disable", + "os_blank_dvd_disable", + "os_bluray_read_only_enforce", + "os_bonjour_disable", + "os_burn_support_disable", + "os_calendar_app_disable", + "os_camera_disable", + "os_cd_read_only_enforce", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_directory_services_configured", + "os_disk_image_disable", + "os_dvdram_disable", + "os_erase_content_and_settings_disable", + "os_external_apfs_hfs_volumes_encrypted", + "os_external_storage_access_defined", + "os_facetime_app_disable", + "os_filevault_authorized_users", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_guest_folder_removed", + "os_handoff_disable", + "os_hibernate_mode_destroyfvkeyonstandby_enable", + "os_hibernate_mode_intel_enable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_internal_apfs_volumes_encrypted", + "os_iphone_mirroring_disable", + "os_ir_support_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-01-root/rules.json b/generated-baselines/all_rules_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..adb837e5 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_bluray_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_bluray_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank Blu Ray. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_cd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_cd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank CD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_dvd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_dvd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank DVD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bluray_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bluray_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Blu Ray Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_calendar_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_calendar_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Calendar.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_camera_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_camera_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Camera. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_cd_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_cd_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce CD Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_directory_services_configured", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_directory_services_configured.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Integrate System into a Directory Services Infrastructure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_disk_image_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_disk_image_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Disk Images. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dvdram_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dvdram_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable DVD-RAM. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_apfs_hfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_authorized_users", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing authorized users that can unlock FileVault", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_authorized_users.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "FileVault Authorized Users. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_guest_folder_removed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_guest_folder_removed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Guest Folder if Present. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_hibernate_mode_destroyfvkeyonstandby_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_hibernate_mode_destroyfvkeyonstandby_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable DestroyFVKeyOnStandby on Hibernate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_hibernate_mode_intel_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_hibernate_mode_intel_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Hibernate Mode (Intel). Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_internal_apfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_internal_apfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All Internal User Storage APFS Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-02-root/discovery.sh b/generated-baselines/all_rules_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..11cb52f7 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1134 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_library_validation_enabled +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.libraryvalidation')\ +.objectForKey('DisableLibraryValidation').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_library_validation_enabled" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_app_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Mail.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_app_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_messages_app_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Messages.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_messages_app_disable" "$normalized_output" + +# os_mobile_file_integrity_enable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/sbin/nvram -p | /usr/bin/grep -c "amfi_get_out_of_my_way=1" +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mobile_file_integrity_enable" "$normalized_output" + +# os_network_storage_restriction +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.NetworkStorage' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_network_storage_restriction" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_parental_controls_enable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ +.objectForKey('familyControlsEnabled').js +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_parental_controls_enable" "$normalized_output" + +# os_password_autofill_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_power_nap_enable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_enable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_removable_media_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["harddisk-external"] +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_removable_media_disable" "$normalized_output" + +# os_root_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_advertising_privacy_protection_enable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_advertising_privacy_protection_enable" "$normalized_output" + +# os_safari_allow_javascript_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Safari')\ +.objectForKey('allowJavaScript').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_allow_javascript_disable" "$normalized_output" + +# os_safari_clear_history_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariHistoryClearing').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_clear_history_disable" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_safari_prevent_cross-site_tracking_enable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_prevent_cross-site_tracking_enable" "$normalized_output" + +# os_safari_private_browsing_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariPrivateBrowsing').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_private_browsing_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_safari_show_full_website_address_enable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_full_website_address_enable" "$normalized_output" + +# os_safari_show_status_bar_enabled +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowOverlayStatusBar = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_status_bar_enabled" "$normalized_output" + +# os_safari_warn_fraudulent_website_enable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_warn_fraudulent_website_enable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_secure_boot_verify +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sleep_and_display_sleep_apple_silicon_enable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +error_count=0 +if /usr/sbin/system_profiler SPHardwareDataType 2>/dev/null | /usr/bin/grep -Ei "MacBook|Mac[0-9]" > /dev/null ; then + cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string) + if echo "$cpuType" | grep -q "Apple"; then + sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') + displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') + if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then + ((error_count++)) + fi + if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then + ((error_count++)) + fi + fi +fi +echo "$error_count" +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sleep_and_display_sleep_apple_silicon_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_software_update_deferral +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('enforcedSoftwareUpdateDelay')) || 0 + if ( timeout <= 30 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_deferral" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_login_grace_time_configure +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_system_wide_applications_configure +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/find /Applications -iname "*\.app" -type d -perm -2 -ls | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_system_wide_applications_configure" "$normalized_output" + +# os_terminal_secure_keyboard_enable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ +.objectForKey('SecureKeyboardEntry').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_terminal_secure_keyboard_enable" "$normalized_output" + +# os_time_offset_limit_configure +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/sntp $(/usr/sbin/systemsetup -getnetworktimeserver | /usr/bin/awk '{print $4}') | /usr/bin/awk -F'.' '/\+\/\-/{if (substr($1,2) >= 270) {print "No"} else {print "Yes"}}' +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_time_offset_limit_configure" "$normalized_output" + +# os_time_server_enabled +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_world_writable_library_folder_configure +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/grep -vE "/Library/AppStore" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_library_folder_configure" "$normalized_output" + +# os_world_writable_system_folder_configure +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_system_folder_configure" "$normalized_output" + +# os_writing_tools_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_lower_case_character_enforce +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_lower_case_character_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# pwpolicy_upper_case_character_enforce +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_upper_case_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/all_rules_macos_26.0/part-02-root/manifest.json b/generated-baselines/all_rules_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..376a7b94 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "all_rules_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "os_library_validation_enabled", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_app_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_messages_app_disable", + "os_mobile_file_integrity_enable", + "os_network_storage_restriction", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_parental_controls_enable", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_power_nap_disable", + "os_power_nap_enable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_removable_media_disable", + "os_root_disable", + "os_safari_advertising_privacy_protection_enable", + "os_safari_allow_javascript_disable", + "os_safari_clear_history_disable", + "os_safari_open_safe_downloads_disable", + "os_safari_prevent_cross-site_tracking_enable", + "os_safari_private_browsing_disable", + "os_safari_reader_summary_disable", + "os_safari_show_full_website_address_enable", + "os_safari_show_status_bar_enabled", + "os_safari_warn_fraudulent_website_enable", + "os_screensaver_loginwindow_enforce", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sleep_and_display_sleep_apple_silicon_enable", + "os_software_update_app_update_enforce", + "os_software_update_deferral", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_login_grace_time_configure", + "os_sshd_per_source_penalties_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_system_wide_applications_configure", + "os_terminal_secure_keyboard_enable", + "os_time_offset_limit_configure", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_world_writable_library_folder_configure", + "os_world_writable_system_folder_configure", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_lower_case_character_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "pwpolicy_upper_case_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-02-root/rules.json b/generated-baselines/all_rules_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..f4f5d6a0 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "os_library_validation_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_library_validation_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Library Validation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Mail App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_messages_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_messages_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Messages App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mobile_file_integrity_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mobile_file_integrity_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Apple Mobile File Integrity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_network_storage_restriction", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_network_storage_restriction.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Network Storage Must Be Restricted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_parental_controls_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_parental_controls_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Parental Controls. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_removable_media_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_removable_media_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Removable Storage Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_advertising_privacy_protection_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Advertising Privacy Protection in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_allow_javascript_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_allow_javascript_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable JavaScript in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_clear_history_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_clear_history_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Clearing of Browsing History in Safari Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_prevent_cross-site_tracking_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Prevent Cross-site Tracking in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_private_browsing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_private_browsing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Private Browsing in Safari Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_full_website_address_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Full Website Address in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_status_bar_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Safari shows the Status Bar is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_warn_fraudulent_website_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sleep_and_display_sleep_apple_silicon_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_deferral", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_deferral.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Software Update Deferment Is Less Than or Equal to true Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_wide_applications_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_wide_applications_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Appropriate Permissions Are Enabled for System Wide Applications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_terminal_secure_keyboard_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Keyboard Entry Terminal.app is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_offset_limit_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_offset_limit_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Offset Within Limits. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_library_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_library_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the Library Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_system_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_system_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the System Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_lower_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_lower_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Lowercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_upper_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_upper_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Uppercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-03-root/discovery.sh b/generated-baselines/all_rules_macos_26.0/part-03-root/discovery.sh new file mode 100644 index 00000000..843ec225 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-03-root/discovery.sh @@ -0,0 +1,840 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_background_security_improvement_removal_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.enableRapidSecurityResponseRollback' +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_background_security_improvement_removal_disable" "$normalized_output" + +# system_settings_biometric_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_menu_enable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ +.objectForKey('Bluetooth').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_menu_enable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_download_software_update_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyDownload' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_download_software_update_enforce" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_install_macos_updates_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallMacOSUpdates').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_install_macos_updates_enforce" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_location_services_menu_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/defaults read /Library/Preferences/com.apple.locationmenu.plist ShowSystemServices +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_location_services_menu_enforce" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_macos_updates_install_enforce +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallOSUpdates' +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_macos_updates_install_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_listen_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/sudo /usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Siri')\ +.objectForKey('VoiceTriggerUserEnabled').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_listen_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_software_update_download_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticDownload').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_software_update_download_enforce" "$normalized_output" + +# system_settings_ssh_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_machine_auto_backup_enable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.TimeMachine')\ +.objectForKey('AutoBackup').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_machine_auto_backup_enable" "$normalized_output" + +# system_settings_time_machine_encrypted_configure +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist | grep -c NotEncrypted +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_time_machine_encrypted_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wake_network_access_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/pmset -g custom | /usr/bin/awk '/womp/ { sum+=$2 } END {print sum}' +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wake_network_access_disable" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# system_settings_wifi_menu_enable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ +.objectForKey('WiFi').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_menu_enable" "$normalized_output" + +# os_secure_enclave +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/all_rules_macos_26.0/part-03-root/manifest.json b/generated-baselines/all_rules_macos_26.0/part-03-root/manifest.json new file mode 100644 index 00000000..f72ea3d5 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-03-root/manifest.json @@ -0,0 +1,67 @@ +{ + "baseline": "all_rules_macos_26.0", + "part": "part-03-root", + "context": "root", + "ruleCount": 59, + "settingNames": [ + "system_settings_background_security_improvement_removal_disable", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_menu_enable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_download_software_update_enforce", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_install_macos_updates_enforce", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_location_services_menu_enforce", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_macos_updates_install_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_listen_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_software_update_download_enforce", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_machine_auto_backup_enable", + "system_settings_time_machine_encrypted_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wake_network_access_disable", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "system_settings_wifi_menu_enable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-03-root/rules.json b/generated-baselines/all_rules_macos_26.0/part-03-root/rules.json new file mode 100644 index 00000000..2d9a4e68 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-03-root/rules.json @@ -0,0 +1,830 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_background_security_improvement_removal_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_background_security_improvement_removal_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable rollback of Background Security Improvements using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_menu_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 18, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_menu_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Bluetooth Menu. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_download_software_update_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_download_software_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_install_macos_updates_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_install_macos_updates_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_location_services_menu_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_location_services_menu_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Location Services Is In the Menu Bar. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_macos_updates_install_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_macos_updates_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_listen_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_listen_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Siri Listen For is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_software_update_download_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_software_update_download_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_auto_backup_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_auto_backup_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Time Machine for Automatic Backups. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_encrypted_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_encrypted_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Machine Volumes are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wake_network_access_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wake_network_access_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Wake for Network Access Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_menu_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 18, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_menu_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Wifi Menu. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-04-user/discovery.sh b/generated-baselines/all_rules_macos_26.0/part-04-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-04-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/all_rules_macos_26.0/part-04-user/manifest.json b/generated-baselines/all_rules_macos_26.0/part-04-user/manifest.json new file mode 100644 index 00000000..786a8b30 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-04-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "all_rules_macos_26.0", + "part": "part-04-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/part-04-user/rules.json b/generated-baselines/all_rules_macos_26.0/part-04-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/part-04-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/all_rules_macos_26.0/unsupported-rules.json b/generated-baselines/all_rules_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..c6f5a5ab --- /dev/null +++ b/generated-baselines/all_rules_macos_26.0/unsupported-rules.json @@ -0,0 +1,554 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_home_folders_default", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_home_folders_default.yaml", + "reason": "No result metadata" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_enable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_allow_info_passed", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_allow_info_passed.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_change_security_attributes", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_change_security_attributes.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_crypto_audit", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_crypto_audit.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_enforce_access_restrictions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_enforce_access_restrictions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_error_message", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_error_message.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_fail_secure_state", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_fail_secure_state.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_grant_privs", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_grant_privs.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_memory_protection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_memory_protection.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_isolate_security_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_isolate_security_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_limit_auditable_events", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_limit_auditable_events.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_limit_gui_sessions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_limit_gui_sessions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logoff_capability_and_message", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logoff_capability_and_message.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_map_pki_identity", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_map_pki_identity.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_mfa_network_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_mfa_network_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_mfa_network_non-priv", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_mfa_network_non-priv.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_peripherals_identify", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_peripherals_identify.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_predictable_behavior", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_predictable_behavior.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_execution", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_execution.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_provide_disconnect_remote_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_provide_disconnect_remote_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_privilege", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_privilege.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_remote_access_methods", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_remote_access_methods.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_remove_software_components_after_updates", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_remove_software_components_after_updates.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_supported_operating_system", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_supported_operating_system.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_terminate_session", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_terminate_session.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_verify_remote_disconnection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_verify_remote_disconnection.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_emergency_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_emergency_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_temporary_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_temporary_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_alert_processing_fail", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_alert_processing_fail.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_enforce_dual_auth", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_enforce_dual_auth.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_limit_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_limit_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_account_created", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_account_created.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_account_disabled", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_account_disabled.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_account_enable", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_account_enable.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_account_modified", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_account_modified.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_account_removal", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_account_removal.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_unauthorized_baseline_change", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_unauthorized_baseline_change.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "pwpolicy_50_percent", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_50_percent.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "pwpolicy_prevent_dictionary_words", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_prevent_dictionary_words.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_non_repudiation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_non_repudiation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_pii_deidentification", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_pii_deidentification.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_pii_quality_control", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_pii_quality_control.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_privacy_principle_minimization", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_privacy_principle_minimization.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_cis_manual", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_cis_manual.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/README.md b/generated-baselines/cis_lvl1_macos_26.0/README.md new file mode 100644 index 00000000..b304aa23 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/README.md @@ -0,0 +1,19 @@ +# cis_lvl1_macos_26.0 + +macOS 26.0: Security Configuration - cis_lvl1 + +This guide describes the actions to take when securing a macOS 26.0 system against the cis_lvl1 security benchmark. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **1** +- `part-03-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **93** +- Unsupported rules skipped: **5** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cis_lvl1_macos_26.0/manifest.json b/generated-baselines/cis_lvl1_macos_26.0/manifest.json new file mode 100644 index 00000000..87bac416 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "cis_lvl1_macos_26.0", + "title": "macOS 26.0: Security Configuration - cis_lvl1", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cis_lvl1 security benchmark.", + "supportedRuleCount": 93, + "unsupportedRuleCount": 5, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cis_lvl1_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 1, + "path": "generated-baselines/cis_lvl1_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cis_lvl1_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..c41d0717 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1185 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# os_airdrop_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_anti_virus_installed +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_authenticated_root_enable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_config_data_install_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_external_apfs_hfs_volumes_encrypted +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No") { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted external volumes: $fail" +fi +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_apfs_hfs_volumes_encrypted" "$normalized_output" + +# os_gatekeeper_enable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_guest_folder_removed +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/ls /Users/ | /usr/bin/grep -c "Guest" +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_guest_folder_removed" "$normalized_output" + +# os_home_folders_secure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_internal_apfs_volumes_encrypted +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted internal user APFS volumes: $fail" +fi +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_internal_apfs_volumes_encrypted" "$normalized_output" + +# os_mail_summary_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mobile_file_integrity_enable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/sbin/nvram -p | /usr/bin/grep -c "amfi_get_out_of_my_way=1" +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mobile_file_integrity_enable" "$normalized_output" + +# os_nfsd_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_hint_remove +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_power_nap_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_root_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_advertising_privacy_protection_enable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_advertising_privacy_protection_enable" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_safari_prevent_cross-site_tracking_enable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_prevent_cross-site_tracking_enable" "$normalized_output" + +# os_safari_show_full_website_address_enable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_full_website_address_enable" "$normalized_output" + +# os_safari_show_status_bar_enabled +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowOverlayStatusBar = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_status_bar_enabled" "$normalized_output" + +# os_safari_warn_fraudulent_website_enable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_warn_fraudulent_website_enable" "$normalized_output" + +# os_sip_enable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_software_update_deferral +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('enforcedSoftwareUpdateDelay')) || 0 + if ( timeout <= 30 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_deferral" "$normalized_output" + +# os_sudo_log_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_wide_applications_configure +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/find /Applications -iname "*\.app" -type d -perm -2 -ls | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_system_wide_applications_configure" "$normalized_output" + +# os_terminal_secure_keyboard_enable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ +.objectForKey('SecureKeyboardEntry').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_terminal_secure_keyboard_enable" "$normalized_output" + +# os_time_server_enabled +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_world_writable_system_folder_configure +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_system_folder_configure" "$normalized_output" + +# os_writing_tools_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 5) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 365 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=15 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_firewall_enable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_install_macos_updates_enforce +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallMacOSUpdates').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_install_macos_updates_enforce" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_location_services_menu_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/defaults read /Library/Preferences/com.apple.locationmenu.plist ShowSystemServices +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_location_services_menu_enforce" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_password_hints_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 900 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_siri_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_software_update_download_enforce +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticDownload').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_software_update_download_enforce" "$normalized_output" + +# system_settings_ssh_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_machine_encrypted_configure +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist | grep -c NotEncrypted +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_time_machine_encrypted_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-01-root/manifest.json b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..39b7e0d3 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cis_lvl1_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "os_airdrop_disable", + "os_anti_virus_installed", + "os_authenticated_root_enable", + "os_config_data_install_enforce", + "os_external_apfs_hfs_volumes_encrypted", + "os_gatekeeper_enable", + "os_guest_folder_removed", + "os_home_folders_secure", + "os_httpd_disable", + "os_install_log_retention_configure", + "os_internal_apfs_volumes_encrypted", + "os_mail_summary_disable", + "os_mobile_file_integrity_enable", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_hint_remove", + "os_power_nap_disable", + "os_root_disable", + "os_safari_advertising_privacy_protection_enable", + "os_safari_open_safe_downloads_disable", + "os_safari_prevent_cross-site_tracking_enable", + "os_safari_show_full_website_address_enable", + "os_safari_show_status_bar_enabled", + "os_safari_warn_fraudulent_website_enable", + "os_sip_enable", + "os_software_update_app_update_enforce", + "os_software_update_deferral", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_wide_applications_configure", + "os_terminal_secure_keyboard_enable", + "os_time_server_enabled", + "os_unlock_active_user_session_disable", + "os_world_writable_system_folder_configure", + "os_writing_tools_disable", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_automatic_login_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_install_macos_updates_enforce", + "system_settings_internet_sharing_disable", + "system_settings_location_services_menu_enforce", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_siri_disable", + "system_settings_smbd_disable", + "system_settings_software_update_download_enforce", + "system_settings_ssh_disable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_machine_encrypted_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-01-root/rules.json b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..41b46d18 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "60d OR 5G", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 60d OR 5G. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_apfs_hfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_guest_folder_removed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_guest_folder_removed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Guest Folder if Present. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_internal_apfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_internal_apfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All Internal User Storage APFS Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mobile_file_integrity_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mobile_file_integrity_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Apple Mobile File Integrity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_advertising_privacy_protection_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Advertising Privacy Protection in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_prevent_cross-site_tracking_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Prevent Cross-site Tracking in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_full_website_address_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Full Website Address in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_status_bar_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Safari shows the Status Bar is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_warn_fraudulent_website_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_deferral", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_deferral.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Software Update Deferment Is Less Than or Equal to true Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_wide_applications_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_wide_applications_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Appropriate Permissions Are Enabled for System Wide Applications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_terminal_secure_keyboard_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Keyboard Entry Terminal.app is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_system_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_system_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the System Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_install_macos_updates_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_install_macos_updates_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_location_services_menu_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_location_services_menu_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Location Services Is In the Menu Bar. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_software_update_download_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_software_update_download_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_encrypted_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_encrypted_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Machine Volumes are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.apple.com", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..efa6ccf8 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_wake_network_access_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/pmset -g custom | /usr/bin/awk '/womp/ { sum+=$2 } END {print sum}' +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wake_network_access_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-02-root/manifest.json b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..6ea3c4c1 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "cis_lvl1_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 1, + "settingNames": [ + "system_settings_wake_network_access_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-02-root/rules.json b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..b0299af9 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-02-root/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_wake_network_access_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wake_network_access_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Wake for Network Access Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-03-user/discovery.sh b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-03-user/manifest.json b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..95683405 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cis_lvl1_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/part-03-user/rules.json b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/part-03-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl1_macos_26.0/unsupported-rules.json b/generated-baselines/cis_lvl1_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..43d7fca5 --- /dev/null +++ b/generated-baselines/cis_lvl1_macos_26.0/unsupported-rules.json @@ -0,0 +1,32 @@ +[ + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_cis_manual", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_cis_manual.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/README.md b/generated-baselines/cis_lvl2_macos_26.0/README.md new file mode 100644 index 00000000..cc272291 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/README.md @@ -0,0 +1,19 @@ +# cis_lvl2_macos_26.0 + +macOS 26.0: Security Configuration - cis_lvl2 + +This guide describes the actions to take when securing a macOS 26.0 system against the cis_lvl2 security benchmark. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **18** +- `part-03-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **110** +- Unsupported rules skipped: **7** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cis_lvl2_macos_26.0/manifest.json b/generated-baselines/cis_lvl2_macos_26.0/manifest.json new file mode 100644 index 00000000..c1ba9cc5 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "cis_lvl2_macos_26.0", + "title": "macOS 26.0: Security Configuration - cis_lvl2", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cis_lvl2 security benchmark.", + "supportedRuleCount": 110, + "unsupportedRuleCount": 7, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cis_lvl2_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 18, + "path": "generated-baselines/cis_lvl2_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cis_lvl2_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..ff5c8f4b --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1152 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# icloud_sync_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_airdrop_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_anti_virus_installed +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_authenticated_root_enable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_config_data_install_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_external_apfs_hfs_volumes_encrypted +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No") { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted external volumes: $fail" +fi +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_apfs_hfs_volumes_encrypted" "$normalized_output" + +# os_gatekeeper_enable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_guest_folder_removed +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/bin/ls /Users/ | /usr/bin/grep -c "Guest" +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_guest_folder_removed" "$normalized_output" + +# os_home_folders_secure +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_internal_apfs_volumes_encrypted +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted internal user APFS volumes: $fail" +fi +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_internal_apfs_volumes_encrypted" "$normalized_output" + +# os_mail_summary_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mobile_file_integrity_enable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/sbin/nvram -p | /usr/bin/grep -c "amfi_get_out_of_my_way=1" +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mobile_file_integrity_enable" "$normalized_output" + +# os_nfsd_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_hint_remove +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_root_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_advertising_privacy_protection_enable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_advertising_privacy_protection_enable" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_safari_prevent_cross-site_tracking_enable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_prevent_cross-site_tracking_enable" "$normalized_output" + +# os_safari_show_full_website_address_enable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_full_website_address_enable" "$normalized_output" + +# os_safari_show_status_bar_enabled +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowOverlayStatusBar = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_status_bar_enabled" "$normalized_output" + +# os_safari_warn_fraudulent_website_enable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_warn_fraudulent_website_enable" "$normalized_output" + +# os_sip_enable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_sleep_and_display_sleep_apple_silicon_enable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +error_count=0 +if /usr/sbin/system_profiler SPHardwareDataType 2>/dev/null | /usr/bin/grep -Ei "MacBook|Mac[0-9]" > /dev/null ; then + cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string) + if echo "$cpuType" | grep -q "Apple"; then + sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') + displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') + if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then + ((error_count++)) + fi + if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then + ((error_count++)) + fi + fi +fi +echo "$error_count" +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sleep_and_display_sleep_apple_silicon_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_software_update_deferral +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('enforcedSoftwareUpdateDelay')) || 0 + if ( timeout <= 30 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_deferral" "$normalized_output" + +# os_sudo_log_enforce +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_wide_applications_configure +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/find /Applications -iname "*\.app" -type d -perm -2 -ls | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_system_wide_applications_configure" "$normalized_output" + +# os_terminal_secure_keyboard_enable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ +.objectForKey('SecureKeyboardEntry').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_terminal_secure_keyboard_enable" "$normalized_output" + +# os_time_server_enabled +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_world_writable_library_folder_configure +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/grep -vE "/Library/AppStore" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_library_folder_configure" "$normalized_output" + +# os_world_writable_system_folder_configure +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_system_folder_configure" "$normalized_output" + +# os_writing_tools_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 5) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 365 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=15 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_firewall_enable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_install_macos_updates_enforce +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallMacOSUpdates').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_install_macos_updates_enforce" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_location_services_menu_enforce +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/defaults read /Library/Preferences/com.apple.locationmenu.plist ShowSystemServices +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_location_services_menu_enforce" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-01-root/manifest.json b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..ff3c5b41 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cis_lvl2_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "icloud_sync_disable", + "os_airdrop_disable", + "os_anti_virus_installed", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_config_data_install_enforce", + "os_external_apfs_hfs_volumes_encrypted", + "os_gatekeeper_enable", + "os_guest_folder_removed", + "os_home_folders_secure", + "os_httpd_disable", + "os_install_log_retention_configure", + "os_internal_apfs_volumes_encrypted", + "os_mail_summary_disable", + "os_mobile_file_integrity_enable", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_hint_remove", + "os_policy_banner_loginwindow_enforce", + "os_power_nap_disable", + "os_root_disable", + "os_safari_advertising_privacy_protection_enable", + "os_safari_open_safe_downloads_disable", + "os_safari_prevent_cross-site_tracking_enable", + "os_safari_show_full_website_address_enable", + "os_safari_show_status_bar_enabled", + "os_safari_warn_fraudulent_website_enable", + "os_sip_enable", + "os_sleep_and_display_sleep_apple_silicon_enable", + "os_software_update_app_update_enforce", + "os_software_update_deferral", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_wide_applications_configure", + "os_terminal_secure_keyboard_enable", + "os_time_server_enabled", + "os_unlock_active_user_session_disable", + "os_world_writable_library_folder_configure", + "os_world_writable_system_folder_configure", + "os_writing_tools_disable", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_special_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_automatic_login_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_install_macos_updates_enforce", + "system_settings_internet_sharing_disable", + "system_settings_location_services_menu_enforce", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-01-root/rules.json b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..7aebb0ac --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "60d OR 5G", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 60d OR 5G. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_apfs_hfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_guest_folder_removed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_guest_folder_removed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Guest Folder if Present. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_internal_apfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_internal_apfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All Internal User Storage APFS Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mobile_file_integrity_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mobile_file_integrity_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Apple Mobile File Integrity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_advertising_privacy_protection_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Advertising Privacy Protection in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_prevent_cross-site_tracking_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Prevent Cross-site Tracking in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_full_website_address_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Full Website Address in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_status_bar_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Safari shows the Status Bar is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_warn_fraudulent_website_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sleep_and_display_sleep_apple_silicon_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_deferral", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_deferral.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Software Update Deferment Is Less Than or Equal to true Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_wide_applications_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_wide_applications_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Appropriate Permissions Are Enabled for System Wide Applications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_terminal_secure_keyboard_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Keyboard Entry Terminal.app is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_library_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_library_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the Library Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_system_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_system_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the System Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_install_macos_updates_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_install_macos_updates_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_location_services_menu_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_location_services_menu_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Location Services Is In the Menu Bar. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..860eba81 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,291 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_password_hints_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 900 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_siri_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_software_update_download_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticDownload').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_software_update_download_enforce" "$normalized_output" + +# system_settings_ssh_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_machine_auto_backup_enable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.TimeMachine')\ +.objectForKey('AutoBackup').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_machine_auto_backup_enable" "$normalized_output" + +# system_settings_time_machine_encrypted_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist | grep -c NotEncrypted +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_time_machine_encrypted_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_wake_network_access_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/pmset -g custom | /usr/bin/awk '/womp/ { sum+=$2 } END {print sum}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wake_network_access_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-02-root/manifest.json b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..22d27eaf --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,26 @@ +{ + "baseline": "cis_lvl2_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 18, + "settingNames": [ + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_siri_disable", + "system_settings_smbd_disable", + "system_settings_software_update_download_enforce", + "system_settings_ssh_disable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_machine_auto_backup_enable", + "system_settings_time_machine_encrypted_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_wake_network_access_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-02-root/rules.json b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..32ae61a4 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-02-root/rules.json @@ -0,0 +1,256 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_software_update_download_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_software_update_download_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_auto_backup_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_auto_backup_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Time Machine for Automatic Backups. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_encrypted_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_encrypted_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Machine Volumes are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.apple.com", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wake_network_access_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wake_network_access_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Wake for Network Access Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-03-user/discovery.sh b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-03-user/manifest.json b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..cdb50466 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cis_lvl2_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/part-03-user/rules.json b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/part-03-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cis_lvl2_macos_26.0/unsupported-rules.json b/generated-baselines/cis_lvl2_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..77e909db --- /dev/null +++ b/generated-baselines/cis_lvl2_macos_26.0/unsupported-rules.json @@ -0,0 +1,44 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_enable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_cis_manual", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_cis_manual.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/README.md b/generated-baselines/cisv8_macos_26.0/README.md new file mode 100644 index 00000000..1efabd9f --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/README.md @@ -0,0 +1,21 @@ +# cisv8_macos_26.0 + +macOS 26.0: Security Configuration - cisv8 + +This guide describes the actions to take when securing a macOS 26.0 system against the cisv8 security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **67** +- `part-03-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **159** +- Unsupported rules skipped: **20** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cisv8_macos_26.0/manifest.json b/generated-baselines/cisv8_macos_26.0/manifest.json new file mode 100644 index 00000000..2b5ff8be --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "cisv8_macos_26.0", + "title": "macOS 26.0: Security Configuration - cisv8", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cisv8 security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 159, + "unsupportedRuleCount": 20, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cisv8_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 67, + "path": "generated-baselines/cisv8_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cisv8_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cisv8_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..80e6436c --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1126 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_anti_virus_installed +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_appleid_prompt_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_config_data_install_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_dictation_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_directory_services_configured +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/dscl localhost -list . | /usr/bin/grep -qvE '(Contact|Search|Local|^$)'; /bin/echo $? +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_directory_services_configured" "$normalized_output" + +# os_external_apfs_hfs_volumes_encrypted +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No") { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted external volumes: $fail" +fi +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_apfs_hfs_volumes_encrypted" "$normalized_output" + +# os_filevault_autologin_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_gatekeeper_enable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_handoff_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_internal_apfs_volumes_encrypted +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk ' + /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)} + /FileVault:/{ + if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) { + if (list=="") list=name; else list=list ", " name + } + } + END{print list}') +if [ -z "$fail" ]; then + /bin/echo "Yes" +else + /bin/echo "Unencrypted internal user APFS volumes: $fail" +fi +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_internal_apfs_volumes_encrypted" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_library_validation_enabled +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.libraryvalidation')\ +.objectForKey('DisableLibraryValidation').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_library_validation_enabled" "$normalized_output" + +# os_mail_summary_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_mobile_file_integrity_enable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/sbin/nvram -p | /usr/bin/grep -c "amfi_get_out_of_my_way=1" +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mobile_file_integrity_enable" "$normalized_output" + +# os_nfsd_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_power_nap_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_root_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_advertising_privacy_protection_enable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_advertising_privacy_protection_enable" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_safari_prevent_cross-site_tracking_enable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_prevent_cross-site_tracking_enable" "$normalized_output" + +# os_safari_show_full_website_address_enable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_full_website_address_enable" "$normalized_output" + +# os_safari_show_status_bar_enabled +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowOverlayStatusBar = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_status_bar_enabled" "$normalized_output" + +# os_safari_warn_fraudulent_website_enable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_warn_fraudulent_website_enable" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sleep_and_display_sleep_apple_silicon_enable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +error_count=0 +if /usr/sbin/system_profiler SPHardwareDataType 2>/dev/null | /usr/bin/grep -Ei "MacBook|Mac[0-9]" > /dev/null ; then + cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string) + if echo "$cpuType" | grep -q "Apple"; then + sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') + displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') + if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then + ((error_count++)) + fi + if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then + ((error_count++)) + fi + fi +fi +echo "$error_count" +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sleep_and_display_sleep_apple_silicon_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_sudo_log_enforce +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_wide_applications_configure +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/find /Applications -iname "*\.app" -type d -perm -2 -ls | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_system_wide_applications_configure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cisv8_macos_26.0/part-01-root/manifest.json b/generated-baselines/cisv8_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..0befc93b --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cisv8_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_anti_virus_installed", + "os_appleid_prompt_disable", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_config_data_install_enforce", + "os_dictation_disable", + "os_directory_services_configured", + "os_external_apfs_hfs_volumes_encrypted", + "os_filevault_autologin_disable", + "os_gatekeeper_enable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_install_log_retention_configure", + "os_internal_apfs_volumes_encrypted", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_library_validation_enabled", + "os_mail_summary_disable", + "os_mdm_require", + "os_mobile_file_integrity_enable", + "os_nfsd_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_root_disable", + "os_safari_advertising_privacy_protection_enable", + "os_safari_open_safe_downloads_disable", + "os_safari_prevent_cross-site_tracking_enable", + "os_safari_show_full_website_address_enable", + "os_safari_show_status_bar_enabled", + "os_safari_warn_fraudulent_website_enable", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_unlock_with_watch_enable", + "os_sleep_and_display_sleep_apple_silicon_enable", + "os_software_update_app_update_enforce", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_wide_applications_configure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-01-root/rules.json b/generated-baselines/cisv8_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..b5829b1f --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_directory_services_configured", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_directory_services_configured.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Integrate System into a Directory Services Infrastructure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_apfs_hfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_apfs_hfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_internal_apfs_volumes_encrypted", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_internal_apfs_volumes_encrypted.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure All Internal User Storage APFS Volumes Are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_library_validation_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_library_validation_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Library Validation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mobile_file_integrity_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mobile_file_integrity_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Apple Mobile File Integrity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_advertising_privacy_protection_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Advertising Privacy Protection in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_prevent_cross-site_tracking_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Prevent Cross-site Tracking in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_full_website_address_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Full Website Address in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_status_bar_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Safari shows the Status Bar is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_warn_fraudulent_website_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sleep_and_display_sleep_apple_silicon_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Sleep and Display Sleep Is Enabled on Apple Silicon Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_wide_applications_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_wide_applications_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Appropriate Permissions Are Enabled for System Wide Applications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cisv8_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..daf269ee --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,913 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_terminal_secure_keyboard_enable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ +.objectForKey('SecureKeyboardEntry').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_terminal_secure_keyboard_enable" "$normalized_output" + +# os_time_server_enabled +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_world_writable_library_folder_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/find /Library -type d -perm -002 ! -perm -1000 ! -xattrname com.apple.rootless 2>/dev/null | /usr/bin/grep -vE "/Library/AppStore" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_library_folder_configure" "$normalized_output" + +# os_world_writable_system_folder_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/find /System/Volumes/Data/System -type d -perm -2 -ls | /usr/bin/grep -vE "downloadDir|locks" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_world_writable_system_folder_configure" "$normalized_output" + +# os_writing_tools_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_menu_enable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ +.objectForKey('Bluetooth').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_menu_enable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_download_software_update_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyDownload' +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_download_software_update_enforce" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_install_macos_updates_enforce +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallMacOSUpdates').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_install_macos_updates_enforce" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_listen_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/sudo /usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Siri')\ +.objectForKey('VoiceTriggerUserEnabled').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_listen_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_software_update_download_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticDownload').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_software_update_download_enforce" "$normalized_output" + +# system_settings_ssh_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_machine_auto_backup_enable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.TimeMachine')\ +.objectForKey('AutoBackup').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_machine_auto_backup_enable" "$normalized_output" + +# system_settings_time_machine_encrypted_configure +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist | grep -c NotEncrypted +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_time_machine_encrypted_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_wake_network_access_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/pmset -g custom | /usr/bin/awk '/womp/ { sum+=$2 } END {print sum}' +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wake_network_access_disable" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# system_settings_wifi_menu_enable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.controlcenter')\ +.objectForKey('WiFi').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_menu_enable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cisv8_macos_26.0/part-02-root/manifest.json b/generated-baselines/cisv8_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..ae2caa0c --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,75 @@ +{ + "baseline": "cisv8_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 67, + "settingNames": [ + "os_terminal_secure_keyboard_enable", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_world_writable_library_folder_configure", + "os_world_writable_system_folder_configure", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_automatic_login_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_menu_enable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_download_software_update_enforce", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_install_macos_updates_enforce", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_listen_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_software_update_download_enforce", + "system_settings_ssh_disable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_machine_auto_backup_enable", + "system_settings_time_machine_encrypted_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_wake_network_access_disable", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "system_settings_wifi_menu_enable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-02-root/rules.json b/generated-baselines/cisv8_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..acf90bd4 --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-02-root/rules.json @@ -0,0 +1,942 @@ +{ + "Rules": [ + { + "SettingName": "os_terminal_secure_keyboard_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Keyboard Entry Terminal.app is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_library_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_library_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the Library Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_world_writable_system_folder_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_world_writable_system_folder_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure No World Writable Files Exist in the System Folder. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_menu_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 18, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_menu_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Bluetooth Menu. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_download_software_update_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_download_software_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_install_macos_updates_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_install_macos_updates_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_listen_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_listen_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Siri Listen For is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_software_update_download_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_software_update_download_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_auto_backup_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_auto_backup_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Time Machine for Automatic Backups. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_encrypted_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_encrypted_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Machine Volumes are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wake_network_access_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wake_network_access_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Wake for Network Access Is Disabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_menu_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 18, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_menu_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Wifi Menu. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-03-user/discovery.sh b/generated-baselines/cisv8_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cisv8_macos_26.0/part-03-user/manifest.json b/generated-baselines/cisv8_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..85d9ab79 --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cisv8_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/part-03-user/rules.json b/generated-baselines/cisv8_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/part-03-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cisv8_macos_26.0/unsupported-rules.json b/generated-baselines/cisv8_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..e753ba22 --- /dev/null +++ b/generated-baselines/cisv8_macos_26.0/unsupported-rules.json @@ -0,0 +1,122 @@ +[ + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_enable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_mfa_network_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_mfa_network_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_cis_manual", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_cis_manual.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/README.md b/generated-baselines/cmmc_lvl1_macos_26.0/README.md new file mode 100644 index 00000000..78d26842 --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/README.md @@ -0,0 +1,20 @@ +# cmmc_lvl1_macos_26.0 + +macOS 26.0: Security Configuration - cmmc_lvl1 + +This guide describes the actions to take when securing a macOS 26.0 system against the cmmc_lvl1 security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **74** +- `part-02-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **75** +- Unsupported rules skipped: **13** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/manifest.json b/generated-baselines/cmmc_lvl1_macos_26.0/manifest.json new file mode 100644 index 00000000..2ae43fc1 --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/manifest.json @@ -0,0 +1,22 @@ +{ + "baseline": "cmmc_lvl1_macos_26.0", + "title": "macOS 26.0: Security Configuration - cmmc_lvl1", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cmmc_lvl1 security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 75, + "unsupportedRuleCount": 13, + "partCount": 2, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 74, + "path": "generated-baselines/cmmc_lvl1_macos_26.0/part-01-root" + }, + { + "name": "part-02-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/cmmc_lvl1_macos_26.0/part-02-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..fbd22a47 --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1038 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# auth_smartcard_allow +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_enforce +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_config_data_install_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_dictation_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_filevault_autologin_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_gatekeeper_enable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_nfsd_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_root_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_sip_enable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_writing_tools_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_find_my_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_security_update_install +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/manifest.json b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..a9d1c22d --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,82 @@ +{ + "baseline": "cmmc_lvl1_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 74, + "settingNames": [ + "auth_smartcard_allow", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_authenticated_root_enable", + "os_config_data_install_enforce", + "os_dictation_disable", + "os_filevault_autologin_disable", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_photos_enhanced_search_disable", + "os_recovery_lock_enable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_unlock_with_watch_enable", + "os_unlock_active_user_session_disable", + "os_writing_tools_disable", + "pwpolicy_account_lockout_enforce", + "system_settings_automatic_login_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_personalized_advertising_disable", + "system_settings_rae_disable", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/rules.json b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..4a7eea6e --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1040 @@ +{ + "Rules": [ + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/discovery.sh b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/manifest.json b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/manifest.json new file mode 100644 index 00000000..5af84d88 --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "cmmc_lvl1_macos_26.0", + "part": "part-02-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/rules.json b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/part-02-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl1_macos_26.0/unsupported-rules.json b/generated-baselines/cmmc_lvl1_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..65241704 --- /dev/null +++ b/generated-baselines/cmmc_lvl1_macos_26.0/unsupported-rules.json @@ -0,0 +1,80 @@ +[ + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/README.md b/generated-baselines/cmmc_lvl2_macos_26.0/README.md new file mode 100644 index 00000000..b2ff980a --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/README.md @@ -0,0 +1,21 @@ +# cmmc_lvl2_macos_26.0 + +macOS 26.0: Security Configuration - cmmc_lvl2 + +This guide describes the actions to take when securing a macOS 26.0 system against the cmmc_lvl2 security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **89** +- `part-03-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **181** +- Unsupported rules skipped: **34** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/manifest.json b/generated-baselines/cmmc_lvl2_macos_26.0/manifest.json new file mode 100644 index 00000000..1ae24313 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "cmmc_lvl2_macos_26.0", + "title": "macOS 26.0: Security Configuration - cmmc_lvl2", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cmmc_lvl2 security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 181, + "unsupportedRuleCount": 34, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cmmc_lvl2_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 89, + "path": "generated-baselines/cmmc_lvl2_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cmmc_lvl2_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..e9fba6f2 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1118 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_failure_halt +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_blank_bluray_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankbd"] +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_bluray_disable" "$normalized_output" + +# os_blank_cd_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankcd"] +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_cd_disable" "$normalized_output" + +# os_blank_dvd_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankdvd"] +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_dvd_disable" "$normalized_output" + +# os_bluray_read_only_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["bd"] +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bluray_read_only_enforce" "$normalized_output" + +# os_bonjour_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_camera_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCamera').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_camera_disable" "$normalized_output" + +# os_cd_read_only_enforce +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["cd"] +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_cd_read_only_enforce" "$normalized_output" + +# os_certificate_authority_trust +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_disk_image_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["disk-image"] +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_disk_image_disable" "$normalized_output" + +# os_dvdram_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["dvdram"] +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dvdram_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_filevault_autologin_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_nfsd_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_autofill_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/manifest.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..c34f474e --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cmmc_lvl2_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_authenticated_root_enable", + "os_blank_bluray_disable", + "os_blank_cd_disable", + "os_blank_dvd_disable", + "os_bluray_read_only_enforce", + "os_bonjour_disable", + "os_burn_support_disable", + "os_camera_disable", + "os_cd_read_only_enforce", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_disk_image_disable", + "os_dvdram_disable", + "os_erase_content_and_settings_disable", + "os_external_storage_access_defined", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/rules.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..734d0faf --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_bluray_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_bluray_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank Blu Ray. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_cd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_cd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank CD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_dvd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_dvd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank DVD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bluray_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bluray_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Blu Ray Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_camera_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_camera_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Camera. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_cd_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_cd_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce CD Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_disk_image_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_disk_image_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Disk Images. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dvdram_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dvdram_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable DVD-RAM. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..bacbfa03 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1204 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_policy_banner_ssh_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_removable_media_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["harddisk-external"] +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_removable_media_disable" "$normalized_output" + +# os_root_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_login_grace_time_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_time_server_enabled +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# os_secure_enclave +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/manifest.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..f2135fa1 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,97 @@ +{ + "baseline": "cmmc_lvl2_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 89, + "settingNames": [ + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_removable_media_disable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_login_grace_time_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/rules.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..5166deab --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1250 @@ +{ + "Rules": [ + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_removable_media_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_removable_media_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Removable Storage Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/discovery.sh b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/manifest.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..1cbcea12 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cmmc_lvl2_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/rules.json b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/part-03-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cmmc_lvl2_macos_26.0/unsupported-rules.json b/generated-baselines/cmmc_lvl2_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..373a5878 --- /dev/null +++ b/generated-baselines/cmmc_lvl2_macos_26.0/unsupported-rules.json @@ -0,0 +1,206 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/README.md b/generated-baselines/cnssi-1253_high_macos_26.0/README.md new file mode 100644 index 00000000..7fc6672a --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/README.md @@ -0,0 +1,22 @@ +# cnssi-1253_high_macos_26.0 + +macOS 26.0: Security Configuration - cnssi-1253_high + +This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_high security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **90** +- `part-03-root` - context: **root**, rules: **18** +- `part-04-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **200** +- Unsupported rules skipped: **67** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/manifest.json b/generated-baselines/cnssi-1253_high_macos_26.0/manifest.json new file mode 100644 index 00000000..0889fa3f --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/manifest.json @@ -0,0 +1,34 @@ +{ + "baseline": "cnssi-1253_high_macos_26.0", + "title": "macOS 26.0: Security Configuration - cnssi-1253_high", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_high security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 200, + "unsupportedRuleCount": 67, + "partCount": 4, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_high_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_high_macos_26.0/part-02-root" + }, + { + "name": "part-03-root", + "context": "root", + "ruleCount": 18, + "path": "generated-baselines/cnssi-1253_high_macos_26.0/part-03-root" + }, + { + "name": "part-04-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cnssi-1253_high_macos_26.0/part-04-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..5d5f71be --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1138 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_control_acls_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_failure_halt +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_blank_bluray_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankbd"] +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_bluray_disable" "$normalized_output" + +# os_blank_cd_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankcd"] +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_cd_disable" "$normalized_output" + +# os_blank_dvd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankdvd"] +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_dvd_disable" "$normalized_output" + +# os_bluray_read_only_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["bd"] +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bluray_read_only_enforce" "$normalized_output" + +# os_bonjour_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_calendar_app_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_calendar_app_disable" "$normalized_output" + +# os_cd_read_only_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["cd"] +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_cd_read_only_enforce" "$normalized_output" + +# os_certificate_authority_trust +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_disk_image_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["disk-image"] +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_disk_image_disable" "$normalized_output" + +# os_dvdram_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["dvdram"] +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dvdram_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_facetime_app_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_filevault_authorized_users +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/fdesetup list | /usr/bin/awk -F',' '{print $1}' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_authorized_users" "$normalized_output" + +# os_filevault_autologin_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_app_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Mail.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_app_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_messages_app_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Messages.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_messages_app_disable" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/manifest.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..c3cd8abf --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_high_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_blank_bluray_disable", + "os_blank_cd_disable", + "os_blank_dvd_disable", + "os_bluray_read_only_enforce", + "os_bonjour_disable", + "os_burn_support_disable", + "os_calendar_app_disable", + "os_cd_read_only_enforce", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_disk_image_disable", + "os_dvdram_disable", + "os_erase_content_and_settings_disable", + "os_external_storage_access_defined", + "os_facetime_app_disable", + "os_filevault_authorized_users", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_app_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_messages_app_disable", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/rules.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..7ea8ea22 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_bluray_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_bluray_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank Blu Ray. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_cd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_cd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank CD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_dvd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_dvd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank DVD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bluray_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bluray_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Blu Ray Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_calendar_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_calendar_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Calendar.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_cd_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_cd_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce CD Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_disk_image_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_disk_image_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Disk Images. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dvdram_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dvdram_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable DVD-RAM. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_authorized_users", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing authorized users that can unlock FileVault", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_authorized_users.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "FileVault Authorized Users. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Mail App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_messages_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_messages_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Messages App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..a7a9e042 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1177 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_nfsd_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_parental_controls_enable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ +.objectForKey('familyControlsEnabled').js +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_parental_controls_enable" "$normalized_output" + +# os_password_autofill_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_removable_media_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["harddisk-external"] +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_removable_media_disable" "$normalized_output" + +# os_root_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_secure_boot_verify +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_login_grace_time_configure +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_time_server_enabled +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_lower_case_character_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_lower_case_character_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# pwpolicy_upper_case_character_enforce +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_upper_case_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/manifest.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..f092e236 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_high_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_parental_controls_enable", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_removable_media_disable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_login_grace_time_configure", + "os_sshd_per_source_penalties_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_lower_case_character_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "pwpolicy_upper_case_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/rules.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..2bcf321f --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_parental_controls_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_parental_controls_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Parental Controls. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_removable_media_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_removable_media_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Removable Storage Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_lower_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_lower_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Lowercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_upper_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_upper_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Uppercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/discovery.sh b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/discovery.sh new file mode 100644 index 00000000..d3edf919 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/discovery.sh @@ -0,0 +1,292 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# os_secure_enclave +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/manifest.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/manifest.json new file mode 100644 index 00000000..edb4754d --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/manifest.json @@ -0,0 +1,26 @@ +{ + "baseline": "cnssi-1253_high_macos_26.0", + "part": "part-03-root", + "context": "root", + "ruleCount": 18, + "settingNames": [ + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/rules.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/rules.json new file mode 100644 index 00000000..e042a12d --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-03-root/rules.json @@ -0,0 +1,256 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/discovery.sh b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/manifest.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/manifest.json new file mode 100644 index 00000000..32a59b4b --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cnssi-1253_high_macos_26.0", + "part": "part-04-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/rules.json b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/part-04-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_high_macos_26.0/unsupported-rules.json b/generated-baselines/cnssi-1253_high_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..1b5d5f6d --- /dev/null +++ b/generated-baselines/cnssi-1253_high_macos_26.0/unsupported-rules.json @@ -0,0 +1,404 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_home_folders_default", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_home_folders_default.yaml", + "reason": "No result metadata" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_allow_info_passed", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_allow_info_passed.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_change_security_attributes", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_change_security_attributes.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_crypto_audit", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_crypto_audit.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_enforce_access_restrictions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_enforce_access_restrictions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_fail_secure_state", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_fail_secure_state.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_grant_privs", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_grant_privs.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_memory_protection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_memory_protection.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_isolate_security_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_isolate_security_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_limit_gui_sessions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_limit_gui_sessions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logoff_capability_and_message", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logoff_capability_and_message.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_predictable_behavior", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_predictable_behavior.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_execution", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_execution.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_provide_disconnect_remote_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_provide_disconnect_remote_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_privilege", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_privilege.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_remove_software_components_after_updates", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_remove_software_components_after_updates.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_verify_remote_disconnection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_verify_remote_disconnection.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_emergency_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_emergency_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_temporary_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_temporary_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_enforce_dual_auth", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_enforce_dual_auth.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_limit_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_limit_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_notify_unauthorized_baseline_change", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_notify_unauthorized_baseline_change.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_non_repudiation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_non_repudiation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/README.md b/generated-baselines/cnssi-1253_low_macos_26.0/README.md new file mode 100644 index 00000000..3aff9106 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/README.md @@ -0,0 +1,22 @@ +# cnssi-1253_low_macos_26.0 + +macOS 26.0: Security Configuration - cnssi-1253_low + +This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_low security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **90** +- `part-03-root` - context: **root**, rules: **14** +- `part-04-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **196** +- Unsupported rules skipped: **52** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/manifest.json b/generated-baselines/cnssi-1253_low_macos_26.0/manifest.json new file mode 100644 index 00000000..a82bbdef --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/manifest.json @@ -0,0 +1,34 @@ +{ + "baseline": "cnssi-1253_low_macos_26.0", + "title": "macOS 26.0: Security Configuration - cnssi-1253_low", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_low security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 196, + "unsupportedRuleCount": 52, + "partCount": 4, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_low_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_low_macos_26.0/part-02-root" + }, + { + "name": "part-03-root", + "context": "root", + "ruleCount": 14, + "path": "generated-baselines/cnssi-1253_low_macos_26.0/part-03-root" + }, + { + "name": "part-04-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cnssi-1253_low_macos_26.0/part-04-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..3effed94 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1143 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_control_acls_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_failure_halt +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_blank_bluray_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankbd"] +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_bluray_disable" "$normalized_output" + +# os_blank_cd_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankcd"] +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_cd_disable" "$normalized_output" + +# os_blank_dvd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankdvd"] +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_dvd_disable" "$normalized_output" + +# os_bluray_read_only_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["bd"] +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bluray_read_only_enforce" "$normalized_output" + +# os_bonjour_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_calendar_app_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_calendar_app_disable" "$normalized_output" + +# os_cd_read_only_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["cd"] +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_cd_read_only_enforce" "$normalized_output" + +# os_certificate_authority_trust +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_disk_image_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["disk-image"] +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_disk_image_disable" "$normalized_output" + +# os_dvdram_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["dvdram"] +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dvdram_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_facetime_app_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_filevault_autologin_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_app_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Mail.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_app_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_messages_app_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Messages.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_messages_app_disable" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/manifest.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..7c908f78 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_low_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_blank_bluray_disable", + "os_blank_cd_disable", + "os_blank_dvd_disable", + "os_bluray_read_only_enforce", + "os_bonjour_disable", + "os_burn_support_disable", + "os_calendar_app_disable", + "os_cd_read_only_enforce", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_disk_image_disable", + "os_dvdram_disable", + "os_erase_content_and_settings_disable", + "os_external_storage_access_defined", + "os_facetime_app_disable", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_app_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_messages_app_disable", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/rules.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..98a8c6e0 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_bluray_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_bluray_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank Blu Ray. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_cd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_cd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank CD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_dvd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_dvd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank DVD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bluray_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bluray_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Blu Ray Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_calendar_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_calendar_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Calendar.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_cd_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_cd_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce CD Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_disk_image_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_disk_image_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Disk Images. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dvdram_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dvdram_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable DVD-RAM. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Mail App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_messages_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_messages_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Messages App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..8b21ce03 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1195 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_notes_transcription_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_parental_controls_enable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ +.objectForKey('familyControlsEnabled').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_parental_controls_enable" "$normalized_output" + +# os_password_autofill_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_removable_media_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["harddisk-external"] +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_removable_media_disable" "$normalized_output" + +# os_root_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_login_grace_time_configure +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_time_server_enabled +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_lower_case_character_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_lower_case_character_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_upper_case_character_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_upper_case_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/manifest.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..b96ae5ae --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_low_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_parental_controls_enable", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_removable_media_disable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_login_grace_time_configure", + "os_sshd_per_source_penalties_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_lower_case_character_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_upper_case_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/rules.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..b5f9d162 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_parental_controls_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_parental_controls_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Parental Controls. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_removable_media_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_removable_media_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Removable Storage Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_lower_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_lower_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Lowercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_upper_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_upper_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Uppercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/discovery.sh b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/discovery.sh new file mode 100644 index 00000000..c4e6fe12 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/discovery.sh @@ -0,0 +1,229 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_siri_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# os_secure_enclave +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/manifest.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/manifest.json new file mode 100644 index 00000000..1e929c19 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/manifest.json @@ -0,0 +1,22 @@ +{ + "baseline": "cnssi-1253_low_macos_26.0", + "part": "part-03-root", + "context": "root", + "ruleCount": 14, + "settingNames": [ + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/rules.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/rules.json new file mode 100644 index 00000000..133fb9c8 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-03-root/rules.json @@ -0,0 +1,200 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/discovery.sh b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/manifest.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/manifest.json new file mode 100644 index 00000000..af861f4b --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cnssi-1253_low_macos_26.0", + "part": "part-04-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/rules.json b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/part-04-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_low_macos_26.0/unsupported-rules.json b/generated-baselines/cnssi-1253_low_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..757b05bb --- /dev/null +++ b/generated-baselines/cnssi-1253_low_macos_26.0/unsupported-rules.json @@ -0,0 +1,314 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_home_folders_default", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_home_folders_default.yaml", + "reason": "No result metadata" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_allow_info_passed", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_allow_info_passed.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_change_security_attributes", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_change_security_attributes.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_grant_privs", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_grant_privs.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logoff_capability_and_message", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logoff_capability_and_message.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_predictable_behavior", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_predictable_behavior.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_execution", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_execution.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_provide_disconnect_remote_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_provide_disconnect_remote_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_privilege", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_privilege.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_remove_software_components_after_updates", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_remove_software_components_after_updates.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_verify_remote_disconnection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_verify_remote_disconnection.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + }, + { + "ruleId": "supplemental_controls", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_controls.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_filevault", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_filevault.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_firewall_pf", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_firewall_pf.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_password_policy", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_password_policy.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "supplemental_smartcard", + "section": "Supplemental", + "sourcePath": "src/mscp/data/rules/supplemental/supplemental_smartcard.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/README.md b/generated-baselines/cnssi-1253_moderate_macos_26.0/README.md new file mode 100644 index 00000000..98cd954c --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/README.md @@ -0,0 +1,22 @@ +# cnssi-1253_moderate_macos_26.0 + +macOS 26.0: Security Configuration - cnssi-1253_moderate + +This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_moderate security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **90** +- `part-03-root` - context: **root**, rules: **17** +- `part-04-user` - context: **user**, rules: **2** + +## Notes + +- Supported rules generated: **199** +- Unsupported rules skipped: **57** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/manifest.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/manifest.json new file mode 100644 index 00000000..52355ece --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/manifest.json @@ -0,0 +1,34 @@ +{ + "baseline": "cnssi-1253_moderate_macos_26.0", + "title": "macOS 26.0: Security Configuration - cnssi-1253_moderate", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the cnssi-1253_moderate security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 199, + "unsupportedRuleCount": 57, + "partCount": 4, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root" + }, + { + "name": "part-03-root", + "context": "root", + "ruleCount": 17, + "path": "generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root" + }, + { + "name": "part-04-user", + "context": "user", + "ruleCount": 2, + "path": "generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/discovery.sh b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..3effed94 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1143 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_control_acls_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_failure_halt +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_failure_halt" "$normalized_output" + +# audit_files_group_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_blank_bluray_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankbd"] +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_bluray_disable" "$normalized_output" + +# os_blank_cd_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankcd"] +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_cd_disable" "$normalized_output" + +# os_blank_dvd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["blankdvd"] +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_blank_dvd_disable" "$normalized_output" + +# os_bluray_read_only_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["bd"] +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bluray_read_only_enforce" "$normalized_output" + +# os_bonjour_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_burn_support_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '(BurnSupport = off;|ProhibitBurn = 1;)' +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_burn_support_disable" "$normalized_output" + +# os_calendar_app_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_calendar_app_disable" "$normalized_output" + +# os_cd_read_only_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["cd"] +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_cd_read_only_enforce" "$normalized_output" + +# os_certificate_authority_trust +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_config_profile_ui_install_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowUIConfigurationProfileInstallation').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_profile_ui_install_disable" "$normalized_output" + +# os_dictation_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_disk_image_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["disk-image"] +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_disk_image_disable" "$normalized_output" + +# os_dvdram_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["dvdram"] +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dvdram_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_external_storage_access_defined +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_facetime_app_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_filevault_autologin_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mail_app_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Mail.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_app_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_messages_app_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Messages.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_messages_app_disable" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/manifest.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..d6ea5205 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_moderate_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_failure_halt", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_blank_bluray_disable", + "os_blank_cd_disable", + "os_blank_dvd_disable", + "os_bluray_read_only_enforce", + "os_bonjour_disable", + "os_burn_support_disable", + "os_calendar_app_disable", + "os_cd_read_only_enforce", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_config_profile_ui_install_disable", + "os_dictation_disable", + "os_disk_image_disable", + "os_dvdram_disable", + "os_erase_content_and_settings_disable", + "os_external_storage_access_defined", + "os_facetime_app_disable", + "os_filevault_autologin_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mail_app_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_messages_app_disable", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/rules.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..98a8c6e0 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_failure_halt", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_failure_halt.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Shut Down Upon Audit Failure. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_bluray_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_bluray_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank Blu Ray. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_cd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_cd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank CD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_blank_dvd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_blank_dvd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Blank DVD. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bluray_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bluray_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Blu Ray Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_burn_support_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_burn_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Burn Support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_calendar_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_calendar_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Calendar.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_cd_read_only_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "read-only", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_cd_read_only_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce CD Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_profile_ui_install_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_profile_ui_install_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Installation of Configuration Profiles through the User Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_disk_image_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_disk_image_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Disk Images. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dvdram_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dvdram_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable DVD-RAM. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Allowed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Mail App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_messages_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_messages_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Messages App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/discovery.sh b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..f6ab0067 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,1182 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_notes_transcription_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_parental_controls_enable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ +.objectForKey('familyControlsEnabled').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_parental_controls_enable" "$normalized_output" + +# os_password_autofill_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordAutoFill').js +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_autofill_disable" "$normalized_output" + +# os_password_hint_remove +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. +-At any time, the USG may inspect and seize data stored on this IS. +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_power_nap_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_removable_media_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systemuiserver')\ +.objectForKey('mount-controls'))["harddisk-external"] +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_removable_media_disable" "$normalized_output" + +# os_root_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_screensaver_loginwindow_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('moduleName').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_screensaver_loginwindow_enforce" "$normalized_output" + +# os_secure_boot_verify +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_login_grace_time_configure +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_system_read_only +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_time_server_enabled +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 6) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_lower_case_character_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_lower_case_character_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# pwpolicy_upper_case_character_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_upper_case_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_access_smb_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/sbin/sysadminctl -smbGuestAccess status 2>&1 | /usr/bin/grep -c "SMB guest access disabled" +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_guest_access_smb_disable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/manifest.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..7178ca04 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "cnssi-1253_moderate_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_parental_controls_enable", + "os_password_autofill_disable", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_removable_media_disable", + "os_root_disable", + "os_safari_reader_summary_disable", + "os_screensaver_loginwindow_enforce", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant", + "os_sshd_login_grace_time_configure", + "os_sshd_per_source_penalties_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_system_read_only", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_lower_case_character_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "pwpolicy_upper_case_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_access_smb_disable", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/rules.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..fbfefb56 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-02-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_parental_controls_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_parental_controls_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Parental Controls. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_autofill_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_autofill_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Autofill. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_removable_media_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "deny", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_removable_media_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Removable Storage Devices. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_screensaver_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Tahoe", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_screensaver_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 0. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_lower_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_lower_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Lowercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_upper_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_upper_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Uppercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_access_smb_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_access_smb_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Guest Access to Shared SMB Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/discovery.sh b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/discovery.sh new file mode 100644 index 00000000..909ff08d --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/discovery.sh @@ -0,0 +1,272 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_screensaver_password_enforce +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 1200 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# os_secure_enclave +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/manifest.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/manifest.json new file mode 100644 index 00000000..46f3155a --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/manifest.json @@ -0,0 +1,25 @@ +{ + "baseline": "cnssi-1253_moderate_macos_26.0", + "part": "part-03-root", + "context": "root", + "ruleCount": 17, + "settingNames": [ + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_touch_id_settings_disable", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/rules.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/rules.json new file mode 100644 index 00000000..b2e28196 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-03-root/rules.json @@ -0,0 +1,242 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/discovery.sh b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/discovery.sh new file mode 100644 index 00000000..d4fcc309 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/discovery.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +# system_settings_hot_corners_secure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +bl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null)" +tl_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null)" +tr_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null)" +br_corner="$(/usr/bin/defaults read /Users/"$CURRENT_USER"/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null)" + +if [[ "$bl_corner" != "6" ]] && [[ "$tl_corner" != "6" ]] && [[ "$tr_corner" != "6" ]] && [[ "$br_corner" != "6" ]]; then + echo "0" +fi +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_secure" "$normalized_output" + +printf '}' diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/manifest.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/manifest.json new file mode 100644 index 00000000..de616455 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/manifest.json @@ -0,0 +1,10 @@ +{ + "baseline": "cnssi-1253_moderate_macos_26.0", + "part": "part-04-user", + "context": "user", + "ruleCount": 2, + "settingNames": [ + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure" + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/rules.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/rules.json new file mode 100644 index 00000000..13f17440 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/part-04-user/rules.json @@ -0,0 +1,32 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/cnssi-1253_moderate_macos_26.0/unsupported-rules.json b/generated-baselines/cnssi-1253_moderate_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..5a86f163 --- /dev/null +++ b/generated-baselines/cnssi-1253_moderate_macos_26.0/unsupported-rules.json @@ -0,0 +1,344 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_home_folders_default", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_home_folders_default.yaml", + "reason": "No result metadata" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_record_reduction_report_generation", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/audit/audit_record_reduction_report_generation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_allow_info_passed", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_allow_info_passed.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_application_sandboxing", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_application_sandboxing.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_change_security_attributes", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_change_security_attributes.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_enforce_access_restrictions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_enforce_access_restrictions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_grant_privs", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_grant_privs.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_memory_protection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_memory_protection.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_limit_gui_sessions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_limit_gui_sessions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logical_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logical_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_logoff_capability_and_message", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_logoff_capability_and_message.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_predictable_behavior", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_predictable_behavior.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_execution", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_execution.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_priv_functions", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_priv_functions.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prevent_unauthorized_disclosure", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prevent_unauthorized_disclosure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_prohibit_remote_activation_collab_devices", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_prohibit_remote_activation_collab_devices.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_provide_disconnect_remote_access", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_provide_disconnect_remote_access.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_privilege", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_privilege.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_reauth_users_change_authenticators", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_users_change_authenticators.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_remove_software_components_after_updates", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_remove_software_components_after_updates.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_required_crypto_module", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_required_crypto_module.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_unique_identification", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_unique_identification.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_verify_remote_disconnection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_verify_remote_disconnection.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_emergency_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_emergency_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_temporary_accounts_disable", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_temporary_accounts_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "audit_records_processing", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_records_processing.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_continuous_monitoring", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_continuous_monitoring.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_limit_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_limit_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_reauth_devices_change_authenticators", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_reauth_devices_change_authenticators.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_identify_non-org_users", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_identify_non-org_users.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_information_validation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_information_validation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_managed_access_control_points", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_managed_access_control_points.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_non_repudiation", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_non_repudiation.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + } +] \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/README.md b/generated-baselines/disa_stig_macos_26.0/README.md new file mode 100644 index 00000000..ecdff7f1 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/README.md @@ -0,0 +1,19 @@ +# disa_stig_macos_26.0 + +macOS 26.0: Security Configuration - disa_stig + +This guide describes the actions to take when securing a macOS 26.0 system against the disa_stig security benchmark. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **58** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **149** +- Unsupported rules skipped: **11** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/disa_stig_macos_26.0/manifest.json b/generated-baselines/disa_stig_macos_26.0/manifest.json new file mode 100644 index 00000000..86a94ec6 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "disa_stig_macos_26.0", + "title": "macOS 26.0: Security Configuration - disa_stig", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the disa_stig security benchmark.", + "supportedRuleCount": 149, + "unsupportedRuleCount": 11, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/disa_stig_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 58, + "path": "generated-baselines/disa_stig_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/disa_stig_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-01-root/discovery.sh b/generated-baselines/disa_stig_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..a5638955 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1117 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_configure_capacity_notify +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_configure_capacity_notify" "$normalized_output" + +# audit_control_acls_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_aa_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# audit_settings_failure_notify +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_settings_failure_notify" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_appleid_prompt_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("AppleID") +EOS +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_appleid_prompt_disable" "$normalized_output" + +# os_asl_log_files_owner_group_configure +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_owner_group_configure" "$normalized_output" + +# os_asl_log_files_permissions_configure +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_asl_log_files_permissions_configure" "$normalized_output" + +# os_authenticated_root_enable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_camera_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCamera').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_camera_disable" "$normalized_output" + +# os_certificate_authority_trust +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_dictation_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_facetime_app_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_filevault_autologin_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('DisableFDEAutoLogin').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_filevault_autologin_disable" "$normalized_output" + +# os_gatekeeper_enable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_icloud_storage_prompt_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("iCloudStorage") +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_icloud_storage_prompt_disable" "$normalized_output" + +# os_image_playground_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_loginwindow_adminhostinfo_disabled +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.integerForKey('AdminHostInfo') +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_loginwindow_adminhostinfo_disabled" "$normalized_output" + +# os_mdm_require +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_newsyslog_files_owner_group_configure +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_owner_group_configure" "$normalized_output" + +# os_newsyslog_files_permissions_configure +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_newsyslog_files_permissions_configure" "$normalized_output" + +# os_nfsd_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_hint_remove +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_policy_banner_loginwindow_enforce +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_loginwindow_enforce" "$normalized_output" + +# os_policy_banner_ssh_configure +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +bannerText="You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." +test "$(cat /etc/banner)" = "$bannerText" && echo "1" || echo "0" +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_configure" "$normalized_output" + +# os_policy_banner_ssh_enforce +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_policy_banner_ssh_enforce" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_root_disable +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_secure_boot_verify +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_sip_enable +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_skip_unlock_with_watch_enable +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("WatchMigration") +EOS +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_unlock_with_watch_enable" "$normalized_output" + +# os_sshd_channel_timeout_configure +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/sbin/sshd -G | /usr/bin/awk '/channeltimeout/{print $2}' +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_channel_timeout_configure" "$normalized_output" + +# os_sshd_client_alive_count_max_configure +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_count_max_configure" "$normalized_output" + +# os_sshd_client_alive_interval_configure +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_client_alive_interval_configure" "$normalized_output" + +# os_sshd_fips_compliant +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +printf '}' diff --git a/generated-baselines/disa_stig_macos_26.0/part-01-root/manifest.json b/generated-baselines/disa_stig_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..87e90631 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "disa_stig_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_configure_capacity_notify", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "audit_settings_failure_notify", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_appleid_prompt_disable", + "os_asl_log_files_owner_group_configure", + "os_asl_log_files_permissions_configure", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_camera_disable", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_dictation_disable", + "os_erase_content_and_settings_disable", + "os_facetime_app_disable", + "os_filevault_autologin_disable", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_icloud_storage_prompt_disable", + "os_image_playground_disable", + "os_install_log_retention_configure", + "os_iphone_mirroring_disable", + "os_loginwindow_adminhostinfo_disabled", + "os_mdm_require", + "os_newsyslog_files_owner_group_configure", + "os_newsyslog_files_permissions_configure", + "os_nfsd_disable", + "os_on_device_dictation_enforce", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_policy_banner_loginwindow_enforce", + "os_policy_banner_ssh_configure", + "os_policy_banner_ssh_enforce", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_root_disable", + "os_secure_boot_verify", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_skip_unlock_with_watch_enable", + "os_sshd_channel_timeout_configure", + "os_sshd_client_alive_count_max_configure", + "os_sshd_client_alive_interval_configure", + "os_sshd_fips_compliant" + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-01-root/rules.json b/generated-baselines/disa_stig_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..df271411 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_configure_capacity_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 25, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_configure_capacity_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Capacity Warning. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "7d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 7d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_settings_failure_notify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_settings_failure_notify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Failure Notification. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_appleid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_appleid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple ID Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_asl_log_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_asl_log_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Apple System Log Files To Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_camera_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_camera_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Camera. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_filevault_autologin_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_filevault_autologin_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FileVault Automatic Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_icloud_storage_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_icloud_storage_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Storage Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_loginwindow_adminhostinfo_disabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": -1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_loginwindow_adminhostinfo_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent AdminHostInfo from Being Available at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_owner_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_owner_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files Owned by Root and Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_newsyslog_files_permissions_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_newsyslog_files_permissions_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System Log Files to Mode 640 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_loginwindow_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_loginwindow_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Login Window. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Display Policy Banner at Remote Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_policy_banner_ssh_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_policy_banner_ssh_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce SSH to Display Policy Banner. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_unlock_with_watch_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_unlock_with_watch_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unlock with Apple Watch During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_channel_timeout_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "900", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_channel_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Channel Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_count_max_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_count_max_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveCountMax to 1. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_client_alive_interval_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_client_alive_interval_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD ClientAliveInterval to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-02-root/discovery.sh b/generated-baselines/disa_stig_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..fefea232 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,829 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# os_sshd_login_grace_time_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_login_grace_time_configure" "$normalized_output" + +# os_sshd_permit_root_login_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_permit_root_login_configure" "$normalized_output" + +# os_sshd_unused_connection_timeout_configure +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_unused_connection_timeout_configure" "$normalized_output" + +# os_sudo_log_enforce +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_time_server_enabled +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_touchid_prompt_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_account_inactivity_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_account_inactivity_enforce" "$normalized_output" + +# pwpolicy_account_lockout_enforce +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 3) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_enforce" "$normalized_output" + +# pwpolicy_account_lockout_timeout_enforce +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_account_lockout_timeout_enforce" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=14 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_temporary_or_emergency_accounts_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/pwpolicy -u USERNAME getaccountpolicies +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_temporary_or_emergency_accounts_disable" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_automatic_logout_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ +.objectForKey('com.apple.autologout.AutoLogOutDelay').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_automatic_logout_enforce" "$normalized_output" + +# system_settings_biometric_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +# system_settings_bluetooth_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_guest_account_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_hot_corners_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_hot_corners_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_loginwindow_prompt_username_password_enforce +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('SHOWFULLNAME').js +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_loginwindow_prompt_username_password_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 5 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 900 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_siri_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# system_settings_token_removal_enforce +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('tokenRemovalAction').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_token_removal_enforce" "$normalized_output" + +# system_settings_usb_restricted_mode +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS + function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ + .objectForKey('allowUSBRestrictedMode')) + if ( pref1 == false ) { + return("false") + } else { + return("true") + } + } +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_usb_restricted_mode" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/disa_stig_macos_26.0/part-02-root/manifest.json b/generated-baselines/disa_stig_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..4a1f5d51 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,66 @@ +{ + "baseline": "disa_stig_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 58, + "settingNames": [ + "os_sshd_login_grace_time_configure", + "os_sshd_permit_root_login_configure", + "os_sshd_unused_connection_timeout_configure", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_time_server_enabled", + "os_touchid_prompt_disable", + "os_unlock_active_user_session_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_account_inactivity_enforce", + "pwpolicy_account_lockout_enforce", + "pwpolicy_account_lockout_timeout_enforce", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_special_character_enforce", + "pwpolicy_temporary_or_emergency_accounts_disable", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_automatic_login_disable", + "system_settings_automatic_logout_enforce", + "system_settings_biometric_disable", + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_diagnostics_reports_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_guest_account_disable", + "system_settings_hot_corners_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_sharing_disable", + "system_settings_loginwindow_prompt_username_password_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "system_settings_token_removal_enforce", + "system_settings_usb_restricted_mode", + "system_settings_wallet_applepay_settings_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-02-root/rules.json b/generated-baselines/disa_stig_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..04dc4806 --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-02-root/rules.json @@ -0,0 +1,816 @@ +{ + "Rules": [ + { + "SettingName": "os_sshd_login_grace_time_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 30, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_login_grace_time_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Login Grace Time to 30. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_permit_root_login_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "no", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_permit_root_login_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_unused_connection_timeout_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 900, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_unused_connection_timeout_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD Unused Connection Timeout to 900. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_inactivity_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 35, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_inactivity_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Accounts after 35 Days of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit Consecutive Failed Login Attempts to pass. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_account_lockout_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_account_lockout_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Account Lockout Time to pass Minutes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_temporary_or_emergency_accounts_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "the user's applied password policy", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_temporary_or_emergency_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatically Remove or Disable Temporary or Emergency User Accounts within 72 Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_logout_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_logout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Auto Logout After 86400 Seconds of Inactivity. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_hot_corners_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 4, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_hot_corners_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Hot Corners. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_loginwindow_prompt_username_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_loginwindow_prompt_username_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Login Window to Prompt for Username and Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.nist.gov", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_token_removal_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_token_removal_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure User Session Lock When a Smart Token is Removed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_usb_restricted_mode", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_usb_restricted_mode.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "USB Devices Must be Authorized Before Allowing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-03-user/discovery.sh b/generated-baselines/disa_stig_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/disa_stig_macos_26.0/part-03-user/manifest.json b/generated-baselines/disa_stig_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..7ca43fcf --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "disa_stig_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/part-03-user/rules.json b/generated-baselines/disa_stig_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/disa_stig_macos_26.0/unsupported-rules.json b/generated-baselines/disa_stig_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..095c682f --- /dev/null +++ b/generated-baselines/disa_stig_macos_26.0/unsupported-rules.json @@ -0,0 +1,68 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_count_max_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_count_max_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_ssh_server_alive_interval_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_server_alive_interval_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_supported_operating_system", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_supported_operating_system.yaml", + "reason": "No check block" + } +] \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/README.md b/generated-baselines/hicp_lp_macos_26.0/README.md new file mode 100644 index 00000000..9293eb9f --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/README.md @@ -0,0 +1,21 @@ +# hicp_lp_macos_26.0 + +macOS 26.0: Security Configuration - hicp_lp + +This guide describes the actions to take when securing a macOS 26.0 system against the hicp_lp security benchmark. + +Information System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **90** +- `part-02-root` - context: **root**, rules: **33** +- `part-03-user` - context: **user**, rules: **1** + +## Notes + +- Supported rules generated: **124** +- Unsupported rules skipped: **22** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/hicp_lp_macos_26.0/manifest.json b/generated-baselines/hicp_lp_macos_26.0/manifest.json new file mode 100644 index 00000000..bec97591 --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/manifest.json @@ -0,0 +1,28 @@ +{ + "baseline": "hicp_lp_macos_26.0", + "title": "macOS 26.0: Security Configuration - hicp_lp", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the hicp_lp security benchmark.\n\nInformation System Security Officers and benchmark creators can use this catalog of settings in order to assist them in security benchmark creation. This list is a catalog, not a checklist or benchmark, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios.", + "supportedRuleCount": 124, + "unsupportedRuleCount": 22, + "partCount": 3, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 90, + "path": "generated-baselines/hicp_lp_macos_26.0/part-01-root" + }, + { + "name": "part-02-root", + "context": "root", + "ruleCount": 33, + "path": "generated-baselines/hicp_lp_macos_26.0/part-02-root" + }, + { + "name": "part-03-user", + "context": "user", + "ruleCount": 1, + "path": "generated-baselines/hicp_lp_macos_26.0/part-03-user" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-01-root/discovery.sh b/generated-baselines/hicp_lp_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..a4b6573d --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1177 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_auditd_enabled +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_flags_aa_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_aa_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_flags_ex_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ex_configure" "$normalized_output" + +# audit_flags_fd_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fd_configure" "$normalized_output" + +# audit_flags_fr_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fr_configure" "$normalized_output" + +# audit_flags_fw_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_fw_configure" "$normalized_output" + +# audit_flags_lo_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_lo_configure" "$normalized_output" + +# auth_pam_login_smartcard_enforce +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_login_smartcard_enforce" "$normalized_output" + +# auth_pam_su_smartcard_enforce +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_su_smartcard_enforce" "$normalized_output" + +# auth_pam_sudo_smartcard_enforce +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_pam_sudo_smartcard_enforce" "$normalized_output" + +# auth_smartcard_allow +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('allowSmartCard').js +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_allow" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_high +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_high" "$normalized_output" + +# auth_smartcard_certificate_trust_enforce_moderate +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('checkCertificateTrust').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_smartcard_certificate_trust_enforce_moderate" "$normalized_output" + +# auth_smartcard_enforce +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ +.objectForKey('enforceSmartCard').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "auth_smartcard_enforce" "$normalized_output" + +# auth_ssh_password_authentication_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "auth_ssh_password_authentication_disable" "$normalized_output" + +# icloud_addressbook_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudAddressBook').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_addressbook_disable" "$normalized_output" + +# icloud_appleid_system_settings_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.systempreferences.AppleIDSettings" +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "icloud_appleid_system_settings_disable" "$normalized_output" + +# icloud_bookmarks_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudBookmarks').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_bookmarks_disable" "$normalized_output" + +# icloud_calendar_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudCalendar').js +EOS +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_calendar_disable" "$normalized_output" + +# icloud_drive_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_freeform_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudFreeform').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_freeform_disable" "$normalized_output" + +# icloud_game_center_disable +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGameCenter').js +EOS +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_game_center_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_mail_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudMail').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_mail_disable" "$normalized_output" + +# icloud_notes_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudNotes').js +EOS +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_notes_disable" "$normalized_output" + +# icloud_photos_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPhotoLibrary').js +EOS +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_photos_disable" "$normalized_output" + +# icloud_private_relay_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudPrivateRelay').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_private_relay_disable" "$normalized_output" + +# icloud_reminders_disable +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudReminders').js +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_reminders_disable" "$normalized_output" + +# icloud_sync_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_account_modification_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAccountModification').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_account_modification_disable" "$normalized_output" + +# os_airdrop_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirDrop').js +EOS +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_airdrop_disable" "$normalized_output" + +# os_authenticated_root_enable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_bonjour_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ +.objectForKey('NoMulticastAdvertisements').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_bonjour_disable" "$normalized_output" + +# os_calendar_app_disable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Calendar.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_calendar_app_disable" "$normalized_output" + +# os_certificate_authority_trust +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_certificate_authority_trust" "$normalized_output" + +# os_config_data_install_enforce +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('ConfigDataInstall').js +EOS +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_config_data_install_enforce" "$normalized_output" + +# os_dictation_disable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDictation').js +EOS +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_dictation_disable" "$normalized_output" + +# os_erase_content_and_settings_disable +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowEraseContentAndSettings').js +EOS +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_erase_content_and_settings_disable" "$normalized_output" + +# os_facetime_app_disable +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_facetime_app_disable" "$normalized_output" + +# os_firewall_default_deny_require +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/sbin/pfctl -a '*' -sr 2> /dev/null | /usr/bin/grep -c "block drop in all" +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_firewall_default_deny_require" "$normalized_output" + +# os_gatekeeper_enable +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_genmoji_disable +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowGenmoji').js +EOS +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_genmoji_disable" "$normalized_output" + +# os_handoff_disable +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowActivityContinuation').js +EOS +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_handoff_disable" "$normalized_output" + +# os_home_folders_secure +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_image_playground_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowImagePlayground').js +EOS +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_image_playground_disable" "$normalized_output" + +# os_iphone_mirroring_disable +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowiPhoneMirroring').js +EOS +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_iphone_mirroring_disable" "$normalized_output" + +# os_ir_support_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.driver.AppleIRController')\ +.objectForKey('DeviceEnabled').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_ir_support_disable" "$normalized_output" + +# os_mail_app_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Mail.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_app_disable" "$normalized_output" + +# os_mail_smart_reply_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSmartReplies').js +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_smart_reply_disable" "$normalized_output" + +# os_mail_summary_disable +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMailSummary').js +EOS +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_mail_summary_disable" "$normalized_output" + +# os_mdm_require +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_messages_app_disable +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Applications/Messages.app" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_messages_app_disable" "$normalized_output" + +# os_nfsd_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_notes_transcription_disable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscription').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_disable" "$normalized_output" + +# os_notes_transcription_summary_disable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowNotesTranscriptionSummary').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_notes_transcription_summary_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_proximity_disable +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_photos_enhanced_search_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.photos.shareddefaults')\ +.objectForKey('IPXDefaultEnhancedVisualSearchEnabled').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_photos_enhanced_search_disable" "$normalized_output" + +# os_power_nap_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/pmset -g custom | /usr/bin/awk '/powernap/ { sum+=$2 } END {print sum}' +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_power_nap_disable" "$normalized_output" + +# os_privacy_setup_prompt_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Privacy") +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_privacy_setup_prompt_disable" "$normalized_output" + +# os_recovery_lock_enable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_recovery_lock_enable" "$normalized_output" + +# os_safari_reader_summary_disable +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowSafariSummary').js +EOS +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_safari_reader_summary_disable" "$normalized_output" + +# os_secure_boot_verify +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_siri_prompt_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Siri") +EOS +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_siri_prompt_disable" "$normalized_output" + +# os_skip_apple_intelligence_enable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Intelligence") +EOS +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_apple_intelligence_enable" "$normalized_output" + +# os_skip_screen_time_prompt_enable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("ScreenTime") +EOS +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_skip_screen_time_prompt_enable" "$normalized_output" + +# os_sshd_fips_compliant +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +fips_sshd_config=("Ciphers aes128-gcm@openssh.com" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com" "HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" "CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com") +total=0 +for config in $fips_sshd_config; do + total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total) +done + +echo $total +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sshd_fips_compliant" "$normalized_output" + +# os_sshd_per_source_penalties_configure +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/sbin/sshd -G | /usr/bin/grep -q "persourcepenalties no" && echo "no" || echo "yes" +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sshd_per_source_penalties_configure" "$normalized_output" + +# os_system_read_only +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/sbin/system_profiler SPStorageDataType | /usr/bin/awk '/Mount Point: \/$/{x=NR+2}(NR==x){print $2}' +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_system_read_only" "$normalized_output" + +# os_touchid_prompt_disable +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/osascript -l JavaScript 2>/dev/null << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ +.objectForKey('SkipSetupItems').containsObject("Biometric") +EOS +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_touchid_prompt_disable" "$normalized_output" + +# os_user_app_installation_prohibit +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('familyControlsEnabled')) + let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ + .objectForKey('pathBlackList').js + for ( let app in pathlist ) { + if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ + return("true") + } + } + return("false") + } +EOS +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_user_app_installation_prohibit" "$normalized_output" + +# os_writing_tools_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowWritingTools').js +EOS +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_writing_tools_disable" "$normalized_output" + +# pwpolicy_alpha_numeric_enforce +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_alpha_numeric_enforce" "$normalized_output" + +# pwpolicy_custom_regex_enforce +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z]).*$'\''")])' - +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_custom_regex_enforce" "$normalized_output" + +# pwpolicy_history_enforce +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributePasswordHistoryDepth"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 >= 5 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_history_enforce" "$normalized_output" + +# pwpolicy_lower_case_character_enforce +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersLowerCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_lower_case_character_enforce" "$normalized_output" + +# pwpolicy_max_lifetime_enforce +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - | /usr/bin/awk '{ if ($1 <= 60 ) {print "pass"} else {print "fail"}}' | /usr/bin/uniq +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_max_lifetime_enforce" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_083() { + /bin/bash <<'__MSCP_RULE_083__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_083__ +} +raw_output="$(run_check_083 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# pwpolicy_minimum_lifetime_enforce +run_check_084() { + /bin/bash <<'__MSCP_RULE_084__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_084__ +} +raw_output="$(run_check_084 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_lifetime_enforce" "$normalized_output" + +# pwpolicy_simple_sequence_disable +run_check_085() { + /bin/bash <<'__MSCP_RULE_085__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "allowSimple" -c +__MSCP_RULE_085__ +} +raw_output="$(run_check_085 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "pwpolicy_simple_sequence_disable" "$normalized_output" + +# pwpolicy_special_character_enforce +run_check_086() { + /bin/bash <<'__MSCP_RULE_086__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "pass"} else {print "fail"}}' +__MSCP_RULE_086__ +} +raw_output="$(run_check_086 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_special_character_enforce" "$normalized_output" + +# pwpolicy_upper_case_character_enforce +run_check_087() { + /bin/bash <<'__MSCP_RULE_087__' +/usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="minimumAlphaCharactersUpperCase"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 1 ) {print "pass"} else {print "fail"}}' +__MSCP_RULE_087__ +} +raw_output="$(run_check_087 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_upper_case_character_enforce" "$normalized_output" + +# system_settings_airplay_receiver_disable +run_check_088() { + /bin/bash <<'__MSCP_RULE_088__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAirPlayIncomingRequests').js +EOS +__MSCP_RULE_088__ +} +raw_output="$(run_check_088 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_airplay_receiver_disable" "$normalized_output" + +# system_settings_apple_watch_unlock_disable +run_check_089() { + /bin/bash <<'__MSCP_RULE_089__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAutoUnlock').js +EOS +__MSCP_RULE_089__ +} +raw_output="$(run_check_089 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_apple_watch_unlock_disable" "$normalized_output" + +# system_settings_biometric_disable +run_check_090() { + /bin/bash <<'__MSCP_RULE_090__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFingerprintForUnlock').js +EOS +__MSCP_RULE_090__ +} +raw_output="$(run_check_090 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_biometric_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/hicp_lp_macos_26.0/part-01-root/manifest.json b/generated-baselines/hicp_lp_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..087bf17a --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,98 @@ +{ + "baseline": "hicp_lp_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 90, + "settingNames": [ + "audit_auditd_enabled", + "audit_flags_aa_configure", + "audit_flags_ad_configure", + "audit_flags_ex_configure", + "audit_flags_fd_configure", + "audit_flags_fr_configure", + "audit_flags_fw_configure", + "audit_flags_lo_configure", + "auth_pam_login_smartcard_enforce", + "auth_pam_su_smartcard_enforce", + "auth_pam_sudo_smartcard_enforce", + "auth_smartcard_allow", + "auth_smartcard_certificate_trust_enforce_high", + "auth_smartcard_certificate_trust_enforce_moderate", + "auth_smartcard_enforce", + "auth_ssh_password_authentication_disable", + "icloud_addressbook_disable", + "icloud_appleid_system_settings_disable", + "icloud_bookmarks_disable", + "icloud_calendar_disable", + "icloud_drive_disable", + "icloud_freeform_disable", + "icloud_game_center_disable", + "icloud_keychain_disable", + "icloud_mail_disable", + "icloud_notes_disable", + "icloud_photos_disable", + "icloud_private_relay_disable", + "icloud_reminders_disable", + "icloud_sync_disable", + "os_account_modification_disable", + "os_airdrop_disable", + "os_authenticated_root_enable", + "os_bonjour_disable", + "os_calendar_app_disable", + "os_certificate_authority_trust", + "os_config_data_install_enforce", + "os_dictation_disable", + "os_erase_content_and_settings_disable", + "os_facetime_app_disable", + "os_firewall_default_deny_require", + "os_gatekeeper_enable", + "os_genmoji_disable", + "os_handoff_disable", + "os_home_folders_secure", + "os_httpd_disable", + "os_image_playground_disable", + "os_iphone_mirroring_disable", + "os_ir_support_disable", + "os_mail_app_disable", + "os_mail_smart_reply_disable", + "os_mail_summary_disable", + "os_mdm_require", + "os_messages_app_disable", + "os_nfsd_disable", + "os_notes_transcription_disable", + "os_notes_transcription_summary_disable", + "os_on_device_dictation_enforce", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_photos_enhanced_search_disable", + "os_power_nap_disable", + "os_privacy_setup_prompt_disable", + "os_recovery_lock_enable", + "os_safari_reader_summary_disable", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_siri_prompt_disable", + "os_skip_apple_intelligence_enable", + "os_skip_screen_time_prompt_enable", + "os_sshd_fips_compliant", + "os_sshd_per_source_penalties_configure", + "os_system_read_only", + "os_touchid_prompt_disable", + "os_user_app_installation_prohibit", + "os_writing_tools_disable", + "pwpolicy_alpha_numeric_enforce", + "pwpolicy_custom_regex_enforce", + "pwpolicy_history_enforce", + "pwpolicy_lower_case_character_enforce", + "pwpolicy_max_lifetime_enforce", + "pwpolicy_minimum_length_enforce", + "pwpolicy_minimum_lifetime_enforce", + "pwpolicy_simple_sequence_disable", + "pwpolicy_special_character_enforce", + "pwpolicy_upper_case_character_enforce", + "system_settings_airplay_receiver_disable", + "system_settings_apple_watch_unlock_disable", + "system_settings_biometric_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-01-root/rules.json b/generated-baselines/hicp_lp_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..226b8d6d --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1264 @@ +{ + "Rules": [ + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_aa_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_aa_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Authorization and Authentication Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ex_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ex_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Program Execution on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fd_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fd_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Deletions of Object Attributes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fr_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fr_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Read Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_fw_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_fw_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Failed Write Actions on the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_lo_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_lo_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Log In and Log Out Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_login_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_login_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_su_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_su_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for the su Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_pam_sudo_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_pam_sudo_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Multifactor Authentication for Privilege Escalation Through the sudo Command. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_allow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_allow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Allow Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_high", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 3, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_high.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to High. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_certificate_trust_enforce_moderate", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_certificate_trust_enforce_moderate.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Smartcard Certificate Trust to Moderate. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_smartcard_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_smartcard_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Smartcard Authentication. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "auth_ssh_password_authentication_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/auth/auth_ssh_password_authentication_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Authentication for SSH. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_addressbook_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_addressbook_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Address Book. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_appleid_system_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_appleid_system_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Setting for Apple ID. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_bookmarks_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_bookmarks_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Bookmarks. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_calendar_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_calendar_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Calendar Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_freeform_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_freeform_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the iCloud Freeform Services. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_game_center_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_game_center_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Game Center. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_mail_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_mail_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Mail. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_notes_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_notes_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Notes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_photos_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_photos_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Photo Library. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_private_relay_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_private_relay_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Private Relay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_reminders_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_reminders_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Reminders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_account_modification_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_account_modification_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AppleID and Internet Account Modifications. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_airdrop_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_airdrop_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable AirDrop. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_bonjour_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_bonjour_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bonjour Multicast. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_calendar_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_calendar_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Calendar.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_certificate_authority_trust", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "a list containing approved root certificates", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_certificate_authority_trust.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Issue or Obtain Public Key Certificates from an Approved Service Provider. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_config_data_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_config_data_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Installation of XProtect Remediator and Gatekeeper Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_dictation_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_erase_content_and_settings_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_erase_content_and_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Erase Content and Settings. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_facetime_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_facetime_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable FaceTime.app. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_firewall_default_deny_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_firewall_default_deny_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Control Connections to Other Systems via a Deny-All and Allow-by-Exception Firewall Policy. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_genmoji_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_genmoji_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Genmoji AI Creation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_handoff_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_handoff_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Handoff. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_image_playground_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_image_playground_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Image Playground. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_iphone_mirroring_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_iphone_mirroring_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iPhone Mirroring. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_ir_support_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_ir_support_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Infrared (IR) support. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Mail App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_smart_reply_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_smart_reply_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Smart Replies. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mail_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mail_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Mail Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_messages_app_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_messages_app_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Messages App. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_notes_transcription_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_notes_transcription_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Notes Transcription Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_photos_enhanced_search_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_photos_enhanced_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Photos Enhanced Visual Search. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_power_nap_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_power_nap_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Power Nap. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_privacy_setup_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_privacy_setup_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Privacy Setup Services During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_recovery_lock_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_recovery_lock_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Recovery Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_reader_summary_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_reader_summary_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Safari Reader Summary. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_siri_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_siri_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri Setup during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_apple_intelligence_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_apple_intelligence_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_skip_screen_time_prompt_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_skip_screen_time_prompt_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Screen Time Prompt During Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_fips_compliant", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 7, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_fips_compliant.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Limit SSHD to FIPS Compliant Connections. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sshd_per_source_penalties_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sshd_per_source_penalties_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure SSHD PerSourcePenalties. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_system_read_only", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "No", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_system_read_only.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Volume is Read Only. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_touchid_prompt_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_touchid_prompt_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID Prompt during Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_user_app_installation_prohibit", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_user_app_installation_prohibit.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit User Installation of Software into /Users/. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_writing_tools_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_writing_tools_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Apple Intelligence Writing Tools. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_alpha_numeric_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_alpha_numeric_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Numeric Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_custom_regex_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_custom_regex_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords to Match the Defined Custom Regular Expression. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_history_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_history_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Password Reuse for a Minimum of pass Generations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_lower_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_lower_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Lowercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_max_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_max_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Restrict Maximum Password Lifetime to pass Days. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_lifetime_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_lifetime_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Set Minimum Password Lifetime to pass Hours. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_simple_sequence_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_simple_sequence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prohibit Repeating, Ascending, and Descending Character Sequences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_special_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_special_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Special Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_upper_case_character_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_upper_case_character_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Passwords Contain a Minimum of One Uppercase Character. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_airplay_receiver_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_airplay_receiver_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Airplay Receiver. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_apple_watch_unlock_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_apple_watch_unlock_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Prevent Apple Watch from Terminating a Session Lock. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_biometric_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_biometric_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable TouchID/OpticID for Unlocking the Device. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-02-root/discovery.sh b/generated-baselines/hicp_lp_macos_26.0/part-02-root/discovery.sh new file mode 100644 index 00000000..15794765 --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-02-root/discovery.sh @@ -0,0 +1,496 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ +.objectForKey('DisableBluetooth').js +EOS +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_bluetooth_disable" "$normalized_output" + +# system_settings_bluetooth_settings_disable +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_settings_disable" "$normalized_output" + +# system_settings_content_caching_disable +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowContentCaching').js +EOS +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_content_caching_disable" "$normalized_output" + +# system_settings_critical_update_install_enforce +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('CriticalUpdateInstall').js +EOS +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_critical_update_install_enforce" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_external_intelligence_disable +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrations').js +EOS +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_disable" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_guest_account_disable +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_accounts_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Internet-Accounts-Settings.extension +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_internet_accounts_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_security_update_install +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_siri_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowAssistant').js +EOS +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_siri_disable" "$normalized_output" + +# system_settings_siri_settings_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_siri_settings_disable" "$normalized_output" + +# system_settings_smbd_disable +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_ssh_enable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => enabled' +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_ssh_enable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_touch_id_settings_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.Touch-ID-Settings.extension" +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_touch_id_settings_disable" "$normalized_output" + +# system_settings_wallet_applepay_settings_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wallet_applepay_settings_disable" "$normalized_output" + +# system_settings_wifi_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/sbin/networksetup -listallnetworkservices | /usr/bin/grep -c "*Wi-Fi" +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_wifi_disable" "$normalized_output" + +# os_secure_enclave +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/hicp_lp_macos_26.0/part-02-root/manifest.json b/generated-baselines/hicp_lp_macos_26.0/part-02-root/manifest.json new file mode 100644 index 00000000..ad03e8b8 --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-02-root/manifest.json @@ -0,0 +1,41 @@ +{ + "baseline": "hicp_lp_macos_26.0", + "part": "part-02-root", + "context": "root", + "ruleCount": 33, + "settingNames": [ + "system_settings_bluetooth_disable", + "system_settings_bluetooth_settings_disable", + "system_settings_content_caching_disable", + "system_settings_critical_update_install_enforce", + "system_settings_diagnostics_reports_disable", + "system_settings_external_intelligence_disable", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_accounts_disable", + "system_settings_internet_sharing_disable", + "system_settings_media_sharing_disabled", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_security_update_install", + "system_settings_siri_disable", + "system_settings_siri_settings_disable", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_ssh_enable", + "system_settings_system_wide_preferences_configure", + "system_settings_touch_id_settings_disable", + "system_settings_wallet_applepay_settings_disable", + "system_settings_wifi_disable", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-02-root/rules.json b/generated-baselines/hicp_lp_macos_26.0/part-02-root/rules.json new file mode 100644 index 00000000..b1ffbfbf --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-02-root/rules.json @@ -0,0 +1,466 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth When no Approved Device is Connected. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_bluetooth_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Bluetooth System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_content_caching_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_content_caching_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Content Caching Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_critical_update_install_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_critical_update_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Critical Security Updates to be Installed. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integrations. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_accounts_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_accounts_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Internet Accounts System Preference Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_siri_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_siri_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Siri. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_touch_id_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_touch_id_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Touch ID System Settings Pane. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wallet_applepay_settings_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wallet_applepay_settings_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the System Settings Pane for Wallet and Apple Pay. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_wifi_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_wifi_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Wi-Fi Interface. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-03-user/discovery.sh b/generated-baselines/hicp_lp_macos_26.0/part-03-user/discovery.sh new file mode 100644 index 00000000..e27b6edf --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-03-user/discovery.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# system_settings_bluetooth_sharing_disable +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_bluetooth_sharing_disable" "$normalized_output" + +printf '}' diff --git a/generated-baselines/hicp_lp_macos_26.0/part-03-user/manifest.json b/generated-baselines/hicp_lp_macos_26.0/part-03-user/manifest.json new file mode 100644 index 00000000..a7cac3f0 --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-03-user/manifest.json @@ -0,0 +1,9 @@ +{ + "baseline": "hicp_lp_macos_26.0", + "part": "part-03-user", + "context": "user", + "ruleCount": 1, + "settingNames": [ + "system_settings_bluetooth_sharing_disable" + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/part-03-user/rules.json b/generated-baselines/hicp_lp_macos_26.0/part-03-user/rules.json new file mode 100644 index 00000000..c925252f --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/part-03-user/rules.json @@ -0,0 +1,18 @@ +{ + "Rules": [ + { + "SettingName": "system_settings_bluetooth_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_bluetooth_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Bluetooth Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/hicp_lp_macos_26.0/unsupported-rules.json b/generated-baselines/hicp_lp_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..e4050688 --- /dev/null +++ b/generated-baselines/hicp_lp_macos_26.0/unsupported-rules.json @@ -0,0 +1,134 @@ +[ + { + "ruleId": "audit_flags_fm_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_flags_fm_failed_configure", + "section": "Auditing", + "sourcePath": "src/mscp/data/rules/audit/audit_flags_fm_failed_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_firmware_password_require", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_firmware_password_require.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_home_folders_default", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_home_folders_default.yaml", + "reason": "No result metadata" + }, + { + "ruleId": "os_ssh_fips_compliant", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_ssh_fips_compliant.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_uucp_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_uucp_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_location_services_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_location_services_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_implement_cryptography", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_implement_cryptography.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_malicious_code_prevention", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_malicious_code_prevention.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_obscure_password", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_obscure_password.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_separate_functionality", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_separate_functionality.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_store_encrypted_passwords", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_store_encrypted_passwords.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_verify_remote_disconnection", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/os/os_verify_remote_disconnection.yaml", + "reason": "No check block" + }, + { + "ruleId": "pwpolicy_force_password_change", + "section": "Inherent", + "sourcePath": "src/mscp/data/rules/pwpolicy/pwpolicy_force_password_change.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_auth_peripherals", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_auth_peripherals.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_protect_dos_attacks", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_protect_dos_attacks.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_secure_name_resolution", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_secure_name_resolution.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "system_settings_wifi_disable_when_connected_to_ethernet", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_wifi_disable_when_connected_to_ethernet.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_access_control_mobile_devices", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_access_control_mobile_devices.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_nonlocal_maintenance", + "section": "Not Applicable", + "sourcePath": "src/mscp/data/rules/os/os_nonlocal_maintenance.yaml", + "reason": "No check block" + } +] \ No newline at end of file diff --git a/generated-baselines/nlmapgov_base_macos_26.0/README.md b/generated-baselines/nlmapgov_base_macos_26.0/README.md new file mode 100644 index 00000000..580f7c6d --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/README.md @@ -0,0 +1,17 @@ +# nlmapgov_base_macos_26.0 + +macOS 26.0: Security Configuration - nlmapgov_base + +This guide describes the actions to take when securing a macOS 26.0 system against the nlmapgov_base security benchmark. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **36** + +## Notes + +- Supported rules generated: **36** +- Unsupported rules skipped: **3** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/nlmapgov_base_macos_26.0/manifest.json b/generated-baselines/nlmapgov_base_macos_26.0/manifest.json new file mode 100644 index 00000000..09ca6942 --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/manifest.json @@ -0,0 +1,16 @@ +{ + "baseline": "nlmapgov_base_macos_26.0", + "title": "macOS 26.0: Security Configuration - nlmapgov_base", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the nlmapgov_base security benchmark.", + "supportedRuleCount": 36, + "unsupportedRuleCount": 3, + "partCount": 1, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 36, + "path": "generated-baselines/nlmapgov_base_macos_26.0/part-01-root" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/discovery.sh b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..ac7f0010 --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,472 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# os_anti_virus_installed +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_gatekeeper_enable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_mdm_require +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_sip_enable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_sudo_log_enforce +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_time_server_enabled +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=15 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_download_software_update_enforce +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyDownload' +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_download_software_update_enforce" "$normalized_output" + +# system_settings_filevault_enforce +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_account_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_macos_updates_install_enforce +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallOSUpdates' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_macos_updates_install_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_time_server_configure +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# os_secure_enclave +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/manifest.json b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..2beb6357 --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,44 @@ +{ + "baseline": "nlmapgov_base_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 36, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_ad_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "os_anti_virus_installed", + "os_gatekeeper_enable", + "os_mdm_require", + "os_safari_open_safe_downloads_disable", + "os_sip_enable", + "os_software_update_app_update_enforce", + "os_sudo_log_enforce", + "os_time_server_enabled", + "pwpolicy_minimum_length_enforce", + "system_settings_automatic_login_disable", + "system_settings_download_software_update_enforce", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_account_disable", + "system_settings_macos_updates_install_enforce", + "system_settings_security_update_install", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/rules.json b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..5c921c20 --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/part-01-root/rules.json @@ -0,0 +1,508 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "180d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 180d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_download_software_update_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_download_software_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_macos_updates_install_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_macos_updates_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.apple.com", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_base_macos_26.0/unsupported-rules.json b/generated-baselines/nlmapgov_base_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..f7ade25c --- /dev/null +++ b/generated-baselines/nlmapgov_base_macos_26.0/unsupported-rules.json @@ -0,0 +1,20 @@ +[ + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/README.md b/generated-baselines/nlmapgov_plus_macos_26.0/README.md new file mode 100644 index 00000000..a37618a1 --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/README.md @@ -0,0 +1,17 @@ +# nlmapgov_plus_macos_26.0 + +macOS 26.0: Security Configuration - nlmapgov_plus + +This guide describes the actions to take when securing a macOS 26.0 system against the nlmapgov_plus security benchmark. + +## Generated policy parts + +- `part-01-root` - context: **root**, rules: **82** + +## Notes + +- Supported rules generated: **82** +- Unsupported rules skipped: **7** +- Use one Intune custom compliance policy per part. +- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**. +- For `root` context parts, set **Run this script using the logged on credentials** to **No**. diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/manifest.json b/generated-baselines/nlmapgov_plus_macos_26.0/manifest.json new file mode 100644 index 00000000..0d9f35b1 --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/manifest.json @@ -0,0 +1,16 @@ +{ + "baseline": "nlmapgov_plus_macos_26.0", + "title": "macOS 26.0: Security Configuration - nlmapgov_plus", + "description": "This guide describes the actions to take when securing a macOS 26.0 system against the nlmapgov_plus security benchmark.", + "supportedRuleCount": 82, + "unsupportedRuleCount": 7, + "partCount": 1, + "parts": [ + { + "name": "part-01-root", + "context": "root", + "ruleCount": 82, + "path": "generated-baselines/nlmapgov_plus_macos_26.0/part-01-root" + } + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/discovery.sh b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/discovery.sh new file mode 100644 index 00000000..7839ce04 --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/discovery.sh @@ -0,0 +1,1091 @@ +#!/bin/bash + +normalize_output() { + local value="$1" + value=${value//$'\r'/ } + value=${value//$'\n'/ } + value=${value//$'\t'/ } + printf '%s' "$value" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//' +} + +json_escape() { + local value="$1" + value=${value//\\/\\\\} + value=${value//\"/\\\"} + printf '%s' "$value" +} + +emit_separator="" + +emit_string_field() { + local name="$1" + local value="$2" + printf '%s"%s":"%s"' "$emit_separator" "$name" "$(json_escape "$value")" + emit_separator=',' +} + +emit_int_field() { + local name="$1" + local value="$2" + if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then + >&2 echo "[$name] expected integer output but got: $value" + value=0 + fi + printf '%s"%s":%s' "$emit_separator" "$name" "$value" + emit_separator=',' +} + +printf '{' + +# audit_acls_files_configure +run_check_001() { + /bin/bash <<'__MSCP_RULE_001__' +/bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_001__ +} +raw_output="$(run_check_001 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_files_configure" "$normalized_output" + +# audit_acls_folders_configure +run_check_002() { + /bin/bash <<'__MSCP_RULE_002__' +/bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_002__ +} +raw_output="$(run_check_002 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_acls_folders_configure" "$normalized_output" + +# audit_auditd_enabled +run_check_003() { + /bin/bash <<'__MSCP_RULE_003__' +LAUNCHD_RUNNING=$(/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.auditd') +AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") +if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_003__ +} +raw_output="$(run_check_003 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_auditd_enabled" "$normalized_output" + +# audit_control_acls_configure +run_check_004() { + /bin/bash <<'__MSCP_RULE_004__' +/bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" +__MSCP_RULE_004__ +} +raw_output="$(run_check_004 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_acls_configure" "$normalized_output" + +# audit_control_group_configure +run_check_005() { + /bin/bash <<'__MSCP_RULE_005__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' +__MSCP_RULE_005__ +} +raw_output="$(run_check_005 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_group_configure" "$normalized_output" + +# audit_control_mode_configure +run_check_006() { + /bin/bash <<'__MSCP_RULE_006__' +/bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_006__ +} +raw_output="$(run_check_006 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_mode_configure" "$normalized_output" + +# audit_control_owner_configure +run_check_007() { + /bin/bash <<'__MSCP_RULE_007__' +/bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' +__MSCP_RULE_007__ +} +raw_output="$(run_check_007 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_control_owner_configure" "$normalized_output" + +# audit_files_group_configure +run_check_008() { + /bin/bash <<'__MSCP_RULE_008__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' +__MSCP_RULE_008__ +} +raw_output="$(run_check_008 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_group_configure" "$normalized_output" + +# audit_files_mode_configure +run_check_009() { + /bin/bash <<'__MSCP_RULE_009__' +/bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' +__MSCP_RULE_009__ +} +raw_output="$(run_check_009 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_mode_configure" "$normalized_output" + +# audit_files_owner_configure +run_check_010() { + /bin/bash <<'__MSCP_RULE_010__' +/bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' +__MSCP_RULE_010__ +} +raw_output="$(run_check_010 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_files_owner_configure" "$normalized_output" + +# audit_flags_ad_configure +run_check_011() { + /bin/bash <<'__MSCP_RULE_011__' +/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' +__MSCP_RULE_011__ +} +raw_output="$(run_check_011 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_flags_ad_configure" "$normalized_output" + +# audit_folder_group_configure +run_check_012() { + /bin/bash <<'__MSCP_RULE_012__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' +__MSCP_RULE_012__ +} +raw_output="$(run_check_012 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_group_configure" "$normalized_output" + +# audit_folder_owner_configure +run_check_013() { + /bin/bash <<'__MSCP_RULE_013__' +/bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' +__MSCP_RULE_013__ +} +raw_output="$(run_check_013 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folder_owner_configure" "$normalized_output" + +# audit_folders_mode_configure +run_check_014() { + /bin/bash <<'__MSCP_RULE_014__' +/usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') +__MSCP_RULE_014__ +} +raw_output="$(run_check_014 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "audit_folders_mode_configure" "$normalized_output" + +# audit_retention_configure +run_check_015() { + /bin/bash <<'__MSCP_RULE_015__' +/usr/bin/awk -F: '/expire-after/{print $2}' /etc/security/audit_control +__MSCP_RULE_015__ +} +raw_output="$(run_check_015 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "audit_retention_configure" "$normalized_output" + +# icloud_drive_disable +run_check_016() { + /bin/bash <<'__MSCP_RULE_016__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDocumentSync').js +EOS +__MSCP_RULE_016__ +} +raw_output="$(run_check_016 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_drive_disable" "$normalized_output" + +# icloud_keychain_disable +run_check_017() { + /bin/bash <<'__MSCP_RULE_017__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudKeychainSync').js +EOS +__MSCP_RULE_017__ +} +raw_output="$(run_check_017 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_keychain_disable" "$normalized_output" + +# icloud_sync_disable +run_check_018() { + /bin/bash <<'__MSCP_RULE_018__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowCloudDesktopAndDocuments').js +EOS +__MSCP_RULE_018__ +} +raw_output="$(run_check_018 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "icloud_sync_disable" "$normalized_output" + +# os_anti_virus_installed +run_check_019() { + /bin/bash <<'__MSCP_RULE_019__' +/usr/bin/xprotect status | /usr/bin/grep -cE "(launch scans: enabled|background scans: enabled)" +__MSCP_RULE_019__ +} +raw_output="$(run_check_019 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_anti_virus_installed" "$normalized_output" + +# os_authenticated_root_enable +run_check_020() { + /bin/bash <<'__MSCP_RULE_020__' +/sbin/mount | /usr/bin/grep ' / ' | /usr/bin/grep -o 'sealed' +__MSCP_RULE_020__ +} +raw_output="$(run_check_020 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_authenticated_root_enable" "$normalized_output" + +# os_external_storage_access_defined +run_check_021() { + /bin/bash <<'__MSCP_RULE_021__' +/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage' +__MSCP_RULE_021__ +} +raw_output="$(run_check_021 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_external_storage_access_defined" "$normalized_output" + +# os_gatekeeper_enable +run_check_022() { + /bin/bash <<'__MSCP_RULE_022__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment').js +EOS +__MSCP_RULE_022__ +} +raw_output="$(run_check_022 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_gatekeeper_enable" "$normalized_output" + +# os_home_folders_secure +run_check_023() { + /bin/bash <<'__MSCP_RULE_023__' +/usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! \( -perm 700 -o -perm 711 \) | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs +__MSCP_RULE_023__ +} +raw_output="$(run_check_023 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_home_folders_secure" "$normalized_output" + +# os_httpd_disable +run_check_024() { + /bin/bash <<'__MSCP_RULE_024__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"org.apache.httpd" => enabled') +running=$(/bin/launchctl print system/org.apache.httpd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_024__ +} +raw_output="$(run_check_024 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_httpd_disable" "$normalized_output" + +# os_install_log_retention_configure +run_check_025() { + /bin/bash <<'__MSCP_RULE_025__' +/usr/sbin/aslmanager -dd 2>&1 | /usr/bin/awk '/\/var\/log\/install.log$/ {count++} /Processing module com.apple.install/,/Finished/ { for (i=1;i<=NR;i++) { if ($i == "TTL" && $(i+2) >= 365) { ttl="True" }; if ($i == "MAX") {max="True"}}} END{if (count > 1) { print "Multiple config files for /var/log/install, manually remove the extra files"} else if (max == "True") { print "all_max setting is configured, must be removed" } if (ttl != "True") { print "TTL not configured" } else { print "Yes" }}' +__MSCP_RULE_025__ +} +raw_output="$(run_check_025 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_install_log_retention_configure" "$normalized_output" + +# os_mdm_require +run_check_026() { + /bin/bash <<'__MSCP_RULE_026__' +/usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" +__MSCP_RULE_026__ +} +raw_output="$(run_check_026 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_mdm_require" "$normalized_output" + +# os_nfsd_disable +run_check_027() { + /bin/bash <<'__MSCP_RULE_027__' +isDisabled=$(/sbin/nfsd status | /usr/bin/awk '/nfsd service/ {print $NF}') +if [[ "$isDisabled" == "disabled" ]] && [[ -z $(/usr/bin/pgrep nfsd) ]]; then + echo "pass" +else + echo "fail" +fi +__MSCP_RULE_027__ +} +raw_output="$(run_check_027 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_nfsd_disable" "$normalized_output" + +# os_on_device_dictation_enforce +run_check_028() { + /bin/bash <<'__MSCP_RULE_028__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('forceOnDeviceOnlyDictation').js +EOS +__MSCP_RULE_028__ +} +raw_output="$(run_check_028 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_on_device_dictation_enforce" "$normalized_output" + +# os_password_hint_remove +run_check_029() { + /bin/bash <<'__MSCP_RULE_029__' +HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') + +if [ -z "$HINT" ]; then + echo "PASS" +else + echo "FAIL" +fi +__MSCP_RULE_029__ +} +raw_output="$(run_check_029 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_hint_remove" "$normalized_output" + +# os_password_proximity_disable +run_check_030() { + /bin/bash <<'__MSCP_RULE_030__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordProximityRequests').js +EOS +__MSCP_RULE_030__ +} +raw_output="$(run_check_030 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_proximity_disable" "$normalized_output" + +# os_password_sharing_disable +run_check_031() { + /bin/bash <<'__MSCP_RULE_031__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowPasswordSharing').js +EOS +__MSCP_RULE_031__ +} +raw_output="$(run_check_031 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_password_sharing_disable" "$normalized_output" + +# os_root_disable +run_check_032() { + /bin/bash <<'__MSCP_RULE_032__' +/usr/bin/dscl '/Local/Default' read '/Users/root' AuthenticationAuthority 2>/dev/null | /usr/bin/grep -c 'AuthenticationAuthority' +__MSCP_RULE_032__ +} +raw_output="$(run_check_032 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_root_disable" "$normalized_output" + +# os_safari_advertising_privacy_protection_enable +run_check_033() { + /bin/bash <<'__MSCP_RULE_033__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c '"WebKitPreferences.privateClickMeasurementEnabled" = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_033__ +} +raw_output="$(run_check_033 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_advertising_privacy_protection_enable" "$normalized_output" + +# os_safari_open_safe_downloads_disable +run_check_034() { + /bin/bash <<'__MSCP_RULE_034__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'AutoOpenSafeDownloads = 0' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_034__ +} +raw_output="$(run_check_034 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_open_safe_downloads_disable" "$normalized_output" + +# os_safari_prevent_cross-site_tracking_enable +run_check_035() { + /bin/bash <<'__MSCP_RULE_035__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -cE '"WebKitPreferences.storageBlockingPolicy" = 1|"WebKitStorageBlockingPolicy" = 1|"BlockStoragePolicy" =2' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_035__ +} +raw_output="$(run_check_035 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_prevent_cross-site_tracking_enable" "$normalized_output" + +# os_safari_show_full_website_address_enable +run_check_036() { + /bin/bash <<'__MSCP_RULE_036__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowFullURLInSmartSearchField = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_036__ +} +raw_output="$(run_check_036 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_full_website_address_enable" "$normalized_output" + +# os_safari_show_status_bar_enabled +run_check_037() { + /bin/bash <<'__MSCP_RULE_037__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'ShowOverlayStatusBar = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_037__ +} +raw_output="$(run_check_037 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_show_status_bar_enabled" "$normalized_output" + +# os_safari_warn_fraudulent_website_enable +run_check_038() { + /bin/bash <<'__MSCP_RULE_038__' +/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'WarnAboutFraudulentWebsites = 1' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}' +__MSCP_RULE_038__ +} +raw_output="$(run_check_038 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_safari_warn_fraudulent_website_enable" "$normalized_output" + +# os_secure_boot_verify +run_check_039() { + /bin/bash <<'__MSCP_RULE_039__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "SecureBootLevel = full" +__MSCP_RULE_039__ +} +raw_output="$(run_check_039 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_boot_verify" "$normalized_output" + +# os_setup_assistant_filevault_enforce +run_check_040() { + /bin/bash <<'__MSCP_RULE_040__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ +.objectForKey('ForceEnableInSetupAssistant') +EOS +__MSCP_RULE_040__ +} +raw_output="$(run_check_040 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_setup_assistant_filevault_enforce" "$normalized_output" + +# os_sip_enable +run_check_041() { + /bin/bash <<'__MSCP_RULE_041__' +/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' +__MSCP_RULE_041__ +} +raw_output="$(run_check_041 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sip_enable" "$normalized_output" + +# os_software_update_app_update_enforce +run_check_042() { + /bin/bash <<'__MSCP_RULE_042__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ +.objectForKey('AutomaticallyInstallAppUpdates').js +EOS +__MSCP_RULE_042__ +} +raw_output="$(run_check_042 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_software_update_app_update_enforce" "$normalized_output" + +# os_sudo_log_enforce +run_check_043() { + /bin/bash <<'__MSCP_RULE_043__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" +__MSCP_RULE_043__ +} +raw_output="$(run_check_043 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_sudo_log_enforce" "$normalized_output" + +# os_sudoers_timestamp_type_configure +run_check_044() { + /bin/bash <<'__MSCP_RULE_044__' +/usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' +__MSCP_RULE_044__ +} +raw_output="$(run_check_044 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_sudoers_timestamp_type_configure" "$normalized_output" + +# os_terminal_secure_keyboard_enable +run_check_045() { + /bin/bash <<'__MSCP_RULE_045__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Terminal')\ +.objectForKey('SecureKeyboardEntry').js +EOS +__MSCP_RULE_045__ +} +raw_output="$(run_check_045 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_terminal_secure_keyboard_enable" "$normalized_output" + +# os_time_server_enabled +run_check_046() { + /bin/bash <<'__MSCP_RULE_046__' +/bin/launchctl print system | /usr/bin/grep -c -E '\tcom.apple.timed' +__MSCP_RULE_046__ +} +raw_output="$(run_check_046 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_time_server_enabled" "$normalized_output" + +# os_unlock_active_user_session_disable +run_check_047() { + /bin/bash <<'__MSCP_RULE_047__' +RESULT="FAIL" +SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -) + +if [[ "${SS_RULE}" == "authenticate-session-owner" ]]; then + RESULT="PASS" +else + PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -) + if /usr/bin/grep -Fxq "authenticate-session-owner" <<<"$PSSO_CHECK"; then + RESULT="PASS" + fi +fi + +echo $RESULT +__MSCP_RULE_047__ +} +raw_output="$(run_check_047 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "os_unlock_active_user_session_disable" "$normalized_output" + +# pwpolicy_minimum_length_enforce +run_check_048() { + /bin/bash <<'__MSCP_RULE_048__' +/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | tail +2 | grep -oE "policyAttributePassword matches '.\{[0-9]+," | awk -F'[{,]' -v ODV=6 '{if ($2 > max) max=$2} END {print (max >= ODV) ? "pass" : "fail"}' +__MSCP_RULE_048__ +} +raw_output="$(run_check_048 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "pwpolicy_minimum_length_enforce" "$normalized_output" + +# system_settings_automatic_login_disable +run_check_049() { + /bin/bash <<'__MSCP_RULE_049__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('com.apple.login.mcx.DisableAutoLoginClient').js +EOS +__MSCP_RULE_049__ +} +raw_output="$(run_check_049 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_automatic_login_disable" "$normalized_output" + +# system_settings_background_security_improvement_removal_disable +run_check_050() { + /bin/bash <<'__MSCP_RULE_050__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.enableRapidSecurityResponseRollback' +__MSCP_RULE_050__ +} +raw_output="$(run_check_050 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_background_security_improvement_removal_disable" "$normalized_output" + +# system_settings_diagnostics_reports_disable +run_check_051() { + /bin/bash <<'__MSCP_RULE_051__' +/usr/bin/osascript -l JavaScript << EOS +function run() { +let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ +.objectForKey('AutoSubmit').js +let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowDiagnosticSubmission').js +if ( pref1 == false && pref2 == false ){ + return("true") +} else { + return("false") +} +} +EOS +__MSCP_RULE_051__ +} +raw_output="$(run_check_051 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_diagnostics_reports_disable" "$normalized_output" + +# system_settings_download_software_update_enforce +run_check_052() { + /bin/bash <<'__MSCP_RULE_052__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyDownload' +__MSCP_RULE_052__ +} +raw_output="$(run_check_052 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_download_software_update_enforce" "$normalized_output" + +# system_settings_external_intelligence_sign_in_disable +run_check_053() { + /bin/bash <<'__MSCP_RULE_053__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowExternalIntelligenceIntegrationsSignIn').js +EOS +__MSCP_RULE_053__ +} +raw_output="$(run_check_053 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_external_intelligence_sign_in_disable" "$normalized_output" + +# system_settings_filevault_enforce +run_check_054() { + /bin/bash <<'__MSCP_RULE_054__' +dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('dontAllowFDEDisable').js +EOS +) +fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.") +if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then + echo "1" +else + echo "0" +fi +__MSCP_RULE_054__ +} +raw_output="$(run_check_054 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_filevault_enforce" "$normalized_output" + +# system_settings_find_my_disable +run_check_055() { + /bin/bash <<'__MSCP_RULE_055__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyDevice')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowFindMyFriends')) + let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ +.objectForKey('DisableFMMiCloudSetting')) + if ( pref1 == false && pref2 == false && pref3 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_055__ +} +raw_output="$(run_check_055 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_find_my_disable" "$normalized_output" + +# system_settings_firewall_enable +run_check_056() { + /bin/bash <<'__MSCP_RULE_056__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableFirewall').js +EOS +__MSCP_RULE_056__ +} +raw_output="$(run_check_056 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_enable" "$normalized_output" + +# system_settings_firewall_stealth_mode_enable +run_check_057() { + /bin/bash <<'__MSCP_RULE_057__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ +.objectForKey('EnableStealthMode').js +EOS +__MSCP_RULE_057__ +} +raw_output="$(run_check_057 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_firewall_stealth_mode_enable" "$normalized_output" + +# system_settings_gatekeeper_identified_developers_allowed +run_check_058() { + /bin/bash <<'__MSCP_RULE_058__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('AllowIdentifiedDevelopers')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ +.objectForKey('EnableAssessment')) + if ( pref1 == true && pref2 == true ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_058__ +} +raw_output="$(run_check_058 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_identified_developers_allowed" "$normalized_output" + +# system_settings_gatekeeper_override_disallow +run_check_059() { + /bin/bash <<'__MSCP_RULE_059__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.managed')\ +.objectForKey('DisableOverride').js +EOS +__MSCP_RULE_059__ +} +raw_output="$(run_check_059 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_gatekeeper_override_disallow" "$normalized_output" + +# system_settings_guest_account_disable +run_check_060() { + /bin/bash <<'__MSCP_RULE_060__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('DisableGuestAccount')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('EnableGuestAccount')) + if ( pref1 == true && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_060__ +} +raw_output="$(run_check_060 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_guest_account_disable" "$normalized_output" + +# system_settings_improve_assistive_voice_disable +run_check_061() { + /bin/bash <<'__MSCP_RULE_061__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ +.objectForKey('AXSAudioDonationSiriImprovementEnabled').js +EOS +__MSCP_RULE_061__ +} +raw_output="$(run_check_061 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_improve_assistive_voice_disable" "$normalized_output" + +# system_settings_improve_search_disable +run_check_062() { + /bin/bash <<'__MSCP_RULE_062__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Search Queries Data Sharing Status').js +EOS +__MSCP_RULE_062__ +} +raw_output="$(run_check_062 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_search_disable" "$normalized_output" + +# system_settings_improve_siri_dictation_disable +run_check_063() { + /bin/bash <<'__MSCP_RULE_063__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ +.objectForKey('Siri Data Sharing Opt-In Status').js +EOS +__MSCP_RULE_063__ +} +raw_output="$(run_check_063 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_improve_siri_dictation_disable" "$normalized_output" + +# system_settings_internet_sharing_disable +run_check_064() { + /bin/bash <<'__MSCP_RULE_064__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('forceInternetSharingOff').js +EOS +__MSCP_RULE_064__ +} +raw_output="$(run_check_064 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_internet_sharing_disable" "$normalized_output" + +# system_settings_macos_updates_install_enforce +run_check_065() { + /bin/bash <<'__MSCP_RULE_065__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallOSUpdates' +__MSCP_RULE_065__ +} +raw_output="$(run_check_065 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_macos_updates_install_enforce" "$normalized_output" + +# system_settings_media_sharing_disabled +run_check_066() { + /bin/bash <<'__MSCP_RULE_066__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharing')) + let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowMediaSharingModification')) + if ( pref1 == false && pref2 == false ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_066__ +} +raw_output="$(run_check_066 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_media_sharing_disabled" "$normalized_output" + +# system_settings_password_hints_disable +run_check_067() { + /bin/bash <<'__MSCP_RULE_067__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ +.objectForKey('RetriesUntilHint').js +EOS +__MSCP_RULE_067__ +} +raw_output="$(run_check_067 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_password_hints_disable" "$normalized_output" + +# system_settings_personalized_advertising_disable +run_check_068() { + /bin/bash <<'__MSCP_RULE_068__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ +.objectForKey('allowApplePersonalizedAdvertising').js +EOS +__MSCP_RULE_068__ +} +raw_output="$(run_check_068 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_personalized_advertising_disable" "$normalized_output" + +# system_settings_printer_sharing_disable +run_check_069() { + /bin/bash <<'__MSCP_RULE_069__' +/usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" +__MSCP_RULE_069__ +} +raw_output="$(run_check_069 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_printer_sharing_disable" "$normalized_output" + +# system_settings_rae_disable +run_check_070() { + /bin/bash <<'__MSCP_RULE_070__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' +__MSCP_RULE_070__ +} +raw_output="$(run_check_070 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_rae_disable" "$normalized_output" + +# system_settings_remote_management_disable +run_check_071() { + /bin/bash <<'__MSCP_RULE_071__' +/usr/libexec/mdmclient QuerySecurityInfo 2>/dev/null | /usr/bin/grep -c "RemoteDesktopEnabled = 0" +__MSCP_RULE_071__ +} +raw_output="$(run_check_071 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_remote_management_disable" "$normalized_output" + +# system_settings_screensaver_ask_for_password_delay_enforce +run_check_072() { + /bin/bash <<'__MSCP_RULE_072__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPasswordDelay')) + if ( delay <= 0 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_072__ +} +raw_output="$(run_check_072 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_ask_for_password_delay_enforce" "$normalized_output" + +# system_settings_screensaver_password_enforce +run_check_073() { + /bin/bash <<'__MSCP_RULE_073__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('askForPassword').js +EOS +__MSCP_RULE_073__ +} +raw_output="$(run_check_073 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_password_enforce" "$normalized_output" + +# system_settings_screensaver_timeout_enforce +run_check_074() { + /bin/bash <<'__MSCP_RULE_074__' +/usr/bin/osascript -l JavaScript << EOS +function run() { + let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ +.objectForKey('idleTime')) + if ( timeout <= 300 ) { + return("true") + } else { + return("false") + } +} +EOS +__MSCP_RULE_074__ +} +raw_output="$(run_check_074 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_screensaver_timeout_enforce" "$normalized_output" + +# system_settings_security_update_install +run_check_075() { + /bin/bash <<'__MSCP_RULE_075__' +/usr/bin/plutil -convert json /var/db/softwareupdate/SoftwareUpdateDDMStatePersistence.plist -o - | /usr/bin/jq --raw-output .'SUCorePersistedStatePolicyFields.SUCoreDDMDeclarationGlobalSettings.automaticallyInstallSystemAndSecurityUpdates' +__MSCP_RULE_075__ +} +raw_output="$(run_check_075 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_security_update_install" "$normalized_output" + +# system_settings_smbd_disable +run_check_076() { + /bin/bash <<'__MSCP_RULE_076__' +/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' +__MSCP_RULE_076__ +} +raw_output="$(run_check_076 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_smbd_disable" "$normalized_output" + +# system_settings_ssh_disable +run_check_077() { + /bin/bash <<'__MSCP_RULE_077__' +result="FAIL" +enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.openssh.sshd" => enabled') +running=$(/bin/launchctl print system/com.openssh.sshd 2>/dev/null) + +if [[ -z "$running" ]] && [[ -z "$enabled" ]]; then + result="PASS" +elif [[ -n "$running" ]]; then + result="${result} RUNNING" +elif [[ -n "$enabled" ]]; then + result="${result} ENABLED" +fi +echo $result +__MSCP_RULE_077__ +} +raw_output="$(run_check_077 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_ssh_disable" "$normalized_output" + +# system_settings_system_wide_preferences_configure +run_check_078() { + /bin/bash <<'__MSCP_RULE_078__' +authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine") +result="1" +for section in ${authDBs[@]}; do + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "authenticate-user")]/following-sibling::*[1])' -) != "true" ]]; then + result="0" + fi + if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "session-owner")]/following-sibling::*[1])' -) != "false" ]]; then + result="0" + fi +done +echo $result +__MSCP_RULE_078__ +} +raw_output="$(run_check_078 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_system_wide_preferences_configure" "$normalized_output" + +# system_settings_time_machine_encrypted_configure +run_check_079() { + /bin/bash <<'__MSCP_RULE_079__' +/usr/bin/sudo /usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist | grep -c NotEncrypted +__MSCP_RULE_079__ +} +raw_output="$(run_check_079 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "system_settings_time_machine_encrypted_configure" "$normalized_output" + +# system_settings_time_server_configure +run_check_080() { + /bin/bash <<'__MSCP_RULE_080__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ +.objectForKey('timeServer').js +EOS +__MSCP_RULE_080__ +} +raw_output="$(run_check_080 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_configure" "$normalized_output" + +# system_settings_time_server_enforce +run_check_081() { + /bin/bash <<'__MSCP_RULE_081__' +/usr/bin/osascript -l JavaScript << EOS +$.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ +.objectForKey('TMAutomaticTimeOnlyEnabled').js +EOS +__MSCP_RULE_081__ +} +raw_output="$(run_check_081 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_string_field "system_settings_time_server_enforce" "$normalized_output" + +# os_secure_enclave +run_check_082() { + /bin/bash <<'__MSCP_RULE_082__' +/usr/sbin/ioreg -w 0 -c AppleSEPManager | /usr/bin/grep -q 'AppleSEPManager'; /bin/echo $? +__MSCP_RULE_082__ +} +raw_output="$(run_check_082 2>/dev/null || true)" +normalized_output="$(normalize_output "$raw_output")" +emit_int_field "os_secure_enclave" "$normalized_output" + +printf '}' diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/manifest.json b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/manifest.json new file mode 100644 index 00000000..ac3c5dec --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/manifest.json @@ -0,0 +1,90 @@ +{ + "baseline": "nlmapgov_plus_macos_26.0", + "part": "part-01-root", + "context": "root", + "ruleCount": 82, + "settingNames": [ + "audit_acls_files_configure", + "audit_acls_folders_configure", + "audit_auditd_enabled", + "audit_control_acls_configure", + "audit_control_group_configure", + "audit_control_mode_configure", + "audit_control_owner_configure", + "audit_files_group_configure", + "audit_files_mode_configure", + "audit_files_owner_configure", + "audit_flags_ad_configure", + "audit_folder_group_configure", + "audit_folder_owner_configure", + "audit_folders_mode_configure", + "audit_retention_configure", + "icloud_drive_disable", + "icloud_keychain_disable", + "icloud_sync_disable", + "os_anti_virus_installed", + "os_authenticated_root_enable", + "os_external_storage_access_defined", + "os_gatekeeper_enable", + "os_home_folders_secure", + "os_httpd_disable", + "os_install_log_retention_configure", + "os_mdm_require", + "os_nfsd_disable", + "os_on_device_dictation_enforce", + "os_password_hint_remove", + "os_password_proximity_disable", + "os_password_sharing_disable", + "os_root_disable", + "os_safari_advertising_privacy_protection_enable", + "os_safari_open_safe_downloads_disable", + "os_safari_prevent_cross-site_tracking_enable", + "os_safari_show_full_website_address_enable", + "os_safari_show_status_bar_enabled", + "os_safari_warn_fraudulent_website_enable", + "os_secure_boot_verify", + "os_setup_assistant_filevault_enforce", + "os_sip_enable", + "os_software_update_app_update_enforce", + "os_sudo_log_enforce", + "os_sudoers_timestamp_type_configure", + "os_terminal_secure_keyboard_enable", + "os_time_server_enabled", + "os_unlock_active_user_session_disable", + "pwpolicy_minimum_length_enforce", + "system_settings_automatic_login_disable", + "system_settings_background_security_improvement_removal_disable", + "system_settings_diagnostics_reports_disable", + "system_settings_download_software_update_enforce", + "system_settings_external_intelligence_sign_in_disable", + "system_settings_filevault_enforce", + "system_settings_find_my_disable", + "system_settings_firewall_enable", + "system_settings_firewall_stealth_mode_enable", + "system_settings_gatekeeper_identified_developers_allowed", + "system_settings_gatekeeper_override_disallow", + "system_settings_guest_account_disable", + "system_settings_improve_assistive_voice_disable", + "system_settings_improve_search_disable", + "system_settings_improve_siri_dictation_disable", + "system_settings_internet_sharing_disable", + "system_settings_macos_updates_install_enforce", + "system_settings_media_sharing_disabled", + "system_settings_password_hints_disable", + "system_settings_personalized_advertising_disable", + "system_settings_printer_sharing_disable", + "system_settings_rae_disable", + "system_settings_remote_management_disable", + "system_settings_screensaver_ask_for_password_delay_enforce", + "system_settings_screensaver_password_enforce", + "system_settings_screensaver_timeout_enforce", + "system_settings_security_update_install", + "system_settings_smbd_disable", + "system_settings_ssh_disable", + "system_settings_system_wide_preferences_configure", + "system_settings_time_machine_encrypted_configure", + "system_settings_time_server_configure", + "system_settings_time_server_enforce", + "os_secure_enclave" + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/rules.json b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/rules.json new file mode 100644 index 00000000..2dc24e64 --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/part-01-root/rules.json @@ -0,0 +1,1152 @@ +{ + "Rules": [ + { + "SettingName": "audit_acls_files_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_files_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_acls_folders_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_acls_folders_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folder to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_auditd_enabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_auditd_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Security Auditing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_acls_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_acls_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control to Not Contain Access Control Lists. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_control_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_control_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit_Control Owner to Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to Mode 440 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_files_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_files_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Files to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_flags_ad_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_flags_ad_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure System to Audit All Administrative Action Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_group_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_group_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders Group to Wheel. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folder_owner_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folder_owner_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to be Owned by Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_folders_mode_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 700, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_folders_mode_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Log Folders to Mode 700 or Less Permissive. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "audit_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "180d", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/audit/audit_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Audit Retention to 180d. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_drive_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_drive_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Document Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_keychain_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_keychain_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Keychain Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "icloud_sync_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/icloud/icloud_sync_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable iCloud Desktop and Document Folder Sync. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_anti_virus_installed", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_anti_virus_installed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Must Use an Approved Antivirus Program. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_authenticated_root_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "sealed", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_authenticated_root_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Authenticated Root. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_external_storage_access_defined", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "ReadOnly", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_external_storage_access_defined.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Access to External Storage Must Be Defined. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_gatekeeper_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_gatekeeper_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Gatekeeper. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_home_folders_secure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_home_folders_secure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Secure User's Home Folders. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_httpd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_httpd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Built-in Web Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_install_log_retention_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "Yes", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_install_log_retention_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Install.log Retention to Yes. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_mdm_require", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_mdm_require.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Enrollment in Mobile Device Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_nfsd_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_nfsd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Network File System Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_on_device_dictation_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_on_device_dictation_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce On Device Dictation. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_hint_remove", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_hint_remove.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Remove Password Hint From User Accounts. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_proximity_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_proximity_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Proximity Based Password Sharing Requests. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_password_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_password_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_root_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_root_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Root Login. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_advertising_privacy_protection_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_advertising_privacy_protection_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Advertising Privacy Protection in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_open_safe_downloads_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_open_safe_downloads_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Automatic Opening of Safe Files in Safari. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_prevent_cross-site_tracking_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_prevent_cross-site_tracking_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Prevent Cross-site Tracking in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_full_website_address_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_full_website_address_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Full Website Address in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_show_status_bar_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_show_status_bar_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Show Safari shows the Status Bar is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_safari_warn_fraudulent_website_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_safari_warn_fraudulent_website_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_boot_verify", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_boot_verify.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Boot Level Set to Full. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_setup_assistant_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_setup_assistant_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault in Setup Assistant. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sip_enable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sip_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure System Integrity Protection is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_software_update_app_update_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_software_update_app_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update App Update Updates Automatically. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudo_log_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudo_log_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudo To Log Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_sudoers_timestamp_type_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "tty", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_sudoers_timestamp_type_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Sudoers Timestamp Type. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_terminal_secure_keyboard_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_terminal_secure_keyboard_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Secure Keyboard Entry Terminal.app is Enabled. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_time_server_enabled", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_time_server_enabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Time Synchronization Daemon. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_unlock_active_user_session_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_unlock_active_user_session_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Login to Other User's Active and Locked Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "pwpolicy_minimum_length_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "pass", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/pwpolicy/pwpolicy_minimum_length_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require a Minimum Password Length of pass Characters. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_automatic_login_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_automatic_login_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Unattended or Automatic Logon to the System. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_background_security_improvement_removal_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_background_security_improvement_removal_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable rollback of Background Security Improvements using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_diagnostics_reports_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_diagnostics_reports_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Diagnostic and Usage Data to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_download_software_update_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_download_software_update_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Software Update Downloads Updates Automatically using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_external_intelligence_sign_in_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_external_intelligence_sign_in_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable External Intelligence Integration Sign In. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_filevault_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_filevault_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce FileVault. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_find_my_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_find_my_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Find My Service. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable macOS Application Firewall. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_firewall_stealth_mode_enable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_firewall_stealth_mode_enable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enable Firewall Stealth Mode. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_identified_developers_allowed", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_identified_developers_allowed.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Apply Gatekeeper Settings to Block Applications from Unidentified Developers. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_gatekeeper_override_disallow", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_gatekeeper_override_disallow.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure Gatekeeper to Disallow End User Override. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_guest_account_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_guest_account_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable the Guest Account. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_assistive_voice_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Sending Audio Recordings and Transcripts to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_search_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_search_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Search Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_improve_siri_dictation_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 2, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_improve_siri_dictation_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Improve Siri and Dictation Information to Apple. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_internet_sharing_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_internet_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Internet Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_macos_updates_install_enforce", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_macos_updates_install_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Updates are Automatically Installed using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_media_sharing_disabled", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_media_sharing_disabled.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Media Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_password_hints_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_password_hints_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Password Hints. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_personalized_advertising_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "false", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_personalized_advertising_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Personalized Advertising. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_printer_sharing_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_printer_sharing_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Printer Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_rae_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_rae_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Apple Events. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_remote_management_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_remote_management_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Remote Management. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_ask_for_password_delay_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_ask_for_password_delay_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Session Lock After Screen Saver is Started. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_password_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_password_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Password. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_screensaver_timeout_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_screensaver_timeout_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Screen Saver Timeout. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_security_update_install", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_security_update_install.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce Automatic Installs of Available Security Updates using DDM.. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_smbd_disable", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_smbd_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable Server Message Block Sharing. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_ssh_disable", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "PASS", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_ssh_disable.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Disable SSH Server for Remote Access Sessions. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_system_wide_preferences_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 1, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_system_wide_preferences_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Require Administrator Password to Modify System-Wide Preferences. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_machine_encrypted_configure", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_machine_encrypted_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Ensure Time Machine Volumes are Encrypted. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_configure", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "time.apple.com", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_configure.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Configure macOS to Use an Authorized Time Server. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "system_settings_time_server_enforce", + "Operator": "IsEquals", + "DataType": "String", + "Operand": "true", + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/system_settings/system_settings_time_server_enforce.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Enforce macOS Time Synchronization. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + }, + { + "SettingName": "os_secure_enclave", + "Operator": "IsEquals", + "DataType": "Int64", + "Operand": 0, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security/blob/main/src/mscp/data/rules/os/os_secure_enclave.yaml", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Protected Storage for Cryptographic Keys. Value discovered was {ActualValue}.", + "Description": "See the linked mSCP rule for implementation and remediation guidance." + } + ] + } + ] +} \ No newline at end of file diff --git a/generated-baselines/nlmapgov_plus_macos_26.0/unsupported-rules.json b/generated-baselines/nlmapgov_plus_macos_26.0/unsupported-rules.json new file mode 100644 index 00000000..f8fcfdee --- /dev/null +++ b/generated-baselines/nlmapgov_plus_macos_26.0/unsupported-rules.json @@ -0,0 +1,44 @@ +[ + { + "ruleId": "os_sudo_timeout_configure", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_sudo_timeout_configure.yaml", + "reason": "No check block" + }, + { + "ruleId": "os_tftpd_disable", + "section": "Operating System", + "sourcePath": "src/mscp/data/rules/os/os_tftpd_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_loginwindow_loginwindowtext_enable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_loginwindow_loginwindowtext_enable.yaml", + "reason": "Unsupported result type: base64" + }, + { + "ruleId": "system_settings_screen_sharing_disable", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_screen_sharing_disable.yaml", + "reason": "No check block" + }, + { + "ruleId": "system_settings_softwareupdate_current", + "section": "System Settings", + "sourcePath": "src/mscp/data/rules/system_settings/system_settings_softwareupdate_current.yaml", + "reason": "No check block" + }, + { + "ruleId": "audit_off_load_records", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/audit/audit_off_load_records.yaml", + "reason": "No macOS enforcement_info" + }, + { + "ruleId": "os_provide_automated_account_management", + "section": "Permanent", + "sourcePath": "src/mscp/data/rules/os/os_provide_automated_account_management.yaml", + "reason": "No macOS enforcement_info" + } +] \ No newline at end of file diff --git a/generated-baselines/summary.json b/generated-baselines/summary.json new file mode 100644 index 00000000..943369d8 --- /dev/null +++ b/generated-baselines/summary.json @@ -0,0 +1,104 @@ +[ + { + "baseline": "800-171_macos_26.0", + "supportedRuleCount": 145, + "unsupportedRuleCount": 33, + "partCount": 3 + }, + { + "baseline": "800-53r5_high_macos_26.0", + "supportedRuleCount": 170, + "unsupportedRuleCount": 53, + "partCount": 3 + }, + { + "baseline": "800-53r5_low_macos_26.0", + "supportedRuleCount": 138, + "unsupportedRuleCount": 30, + "partCount": 3 + }, + { + "baseline": "800-53r5_moderate_macos_26.0", + "supportedRuleCount": 167, + "unsupportedRuleCount": 47, + "partCount": 3 + }, + { + "baseline": "all_rules_macos_26.0", + "supportedRuleCount": 241, + "unsupportedRuleCount": 92, + "partCount": 4 + }, + { + "baseline": "cis_lvl1_macos_26.0", + "supportedRuleCount": 93, + "unsupportedRuleCount": 5, + "partCount": 3 + }, + { + "baseline": "cis_lvl2_macos_26.0", + "supportedRuleCount": 110, + "unsupportedRuleCount": 7, + "partCount": 3 + }, + { + "baseline": "cisv8_macos_26.0", + "supportedRuleCount": 159, + "unsupportedRuleCount": 20, + "partCount": 3 + }, + { + "baseline": "cmmc_lvl1_macos_26.0", + "supportedRuleCount": 75, + "unsupportedRuleCount": 13, + "partCount": 2 + }, + { + "baseline": "cmmc_lvl2_macos_26.0", + "supportedRuleCount": 181, + "unsupportedRuleCount": 34, + "partCount": 3 + }, + { + "baseline": "cnssi-1253_high_macos_26.0", + "supportedRuleCount": 200, + "unsupportedRuleCount": 67, + "partCount": 4 + }, + { + "baseline": "cnssi-1253_low_macos_26.0", + "supportedRuleCount": 196, + "unsupportedRuleCount": 52, + "partCount": 4 + }, + { + "baseline": "cnssi-1253_moderate_macos_26.0", + "supportedRuleCount": 199, + "unsupportedRuleCount": 57, + "partCount": 4 + }, + { + "baseline": "disa_stig_macos_26.0", + "supportedRuleCount": 149, + "unsupportedRuleCount": 11, + "partCount": 3 + }, + { + "baseline": "hicp_lp_macos_26.0", + "supportedRuleCount": 124, + "unsupportedRuleCount": 22, + "partCount": 3 + }, + { + "baseline": "nlmapgov_base_macos_26.0", + "supportedRuleCount": 36, + "unsupportedRuleCount": 3, + "partCount": 1 + }, + { + "baseline": "nlmapgov_plus_macos_26.0", + "supportedRuleCount": 82, + "unsupportedRuleCount": 7, + "partCount": 1 + } +] \ No newline at end of file diff --git a/policies/root-context/discovery.sh b/policies/root-context/discovery.sh new file mode 100644 index 00000000..adba691e --- /dev/null +++ b/policies/root-context/discovery.sh @@ -0,0 +1,105 @@ +#!/bin/bash + +read_jxa_preference() { + local suite="$1" + local key="$2" + + /usr/bin/osascript -l JavaScript 2>/dev/null < 0 )); then + automatic_logout_enabled="true" +fi + +ssh_password_authentication_disabled="false" +ssh_password_setting_count="$(/usr/sbin/sshd -G 2>/dev/null | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' || true)" +if [[ "$ssh_password_setting_count" == "2" ]]; then + ssh_password_authentication_disabled="true" +fi + +failed_login_attempts_maximum="$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath "string(//dict/key[text()='policyAttributeMaximumFailedAuthentications']/following-sibling::integer[1])" - 2>/dev/null)" +failed_login_attempts_maximum="$(safe_int "$failed_login_attempts_maximum")" + +failed_login_lockout_seconds="$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath "string(//dict/key[text()='autoEnableInSeconds']/following-sibling::integer[1])" - 2>/dev/null)" +failed_login_lockout_seconds="$(safe_int "$failed_login_lockout_seconds")" +failed_login_lockout_minutes="$(( failed_login_lockout_seconds / 60 ))" + +password_history_depth="$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath "string(//dict/key[text()='policyAttributePasswordHistoryDepth']/following-sibling::*[1])" - 2>/dev/null)" +password_history_depth="$(safe_int "$password_history_depth")" + +firewall_enabled="false" +firewall_state="$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null || true)" +if printf '%s' "$firewall_state" | /usr/bin/grep -Eiq 'enabled|state *= *[12]'; then + firewall_enabled="true" +fi + +firewall_stealth_mode_enabled="false" +firewall_stealth_state="$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode 2>/dev/null || true)" +if printf '%s' "$firewall_stealth_state" | /usr/bin/grep -iq 'enabled'; then + firewall_stealth_mode_enabled="true" +fi + +screen_sharing_disabled="false" +screen_sharing_enabled_line="$(/bin/launchctl print-disabled system 2>/dev/null | /usr/bin/grep '\"com.apple.screensharing\" => enabled' || true)" +screen_sharing_running_line="$(/bin/launchctl print system/com.apple.screensharing 2>/dev/null || true)" +if [[ -z "$screen_sharing_enabled_line" && -z "$screen_sharing_running_line" ]]; then + screen_sharing_disabled="true" +fi + +printer_sharing_disabled="false" +if /usr/sbin/cupsctl 2>/dev/null | /usr/bin/grep -q '_share_printers=0'; then + printer_sharing_disabled="true" +fi + +gatekeeper_enabled="false" +if /usr/sbin/spctl --status 2>/dev/null | /usr/bin/grep -q 'assessments enabled'; then + gatekeeper_enabled="true" +fi + +printf '{' +printf '"AutomaticLoginDisabled":%s,' "$(bool_literal "$automatic_login_disabled")" +printf '"AutomaticLogoutEnabled":%s,' "$(bool_literal "$automatic_logout_enabled")" +printf '"AutomaticLogoutSeconds":%s,' "$automatic_logout_seconds" +printf '"SshPasswordAuthenticationDisabled":%s,' "$(bool_literal "$ssh_password_authentication_disabled")" +printf '"FailedLoginAttemptsMaximum":%s,' "$failed_login_attempts_maximum" +printf '"FailedLoginLockoutMinutes":%s,' "$failed_login_lockout_minutes" +printf '"PasswordHistoryDepth":%s,' "$password_history_depth" +printf '"FirewallEnabled":%s,' "$(bool_literal "$firewall_enabled")" +printf '"FirewallStealthModeEnabled":%s,' "$(bool_literal "$firewall_stealth_mode_enabled")" +printf '"ScreenSharingDisabled":%s,' "$(bool_literal "$screen_sharing_disabled")" +printf '"PrinterSharingDisabled":%s,' "$(bool_literal "$printer_sharing_disabled")" +printf '"GatekeeperEnabled":%s' "$(bool_literal "$gatekeeper_enabled")" +printf '}' diff --git a/policies/root-context/rules.json b/policies/root-context/rules.json new file mode 100644 index 00000000..47765115 --- /dev/null +++ b/policies/root-context/rules.json @@ -0,0 +1,172 @@ +{ + "Rules": [ + { + "SettingName": "AutomaticLoginDisabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatic logon must be disabled. Value discovered was {ActualValue}.", + "Description": "Disable automatic login in macOS Login Options or enforce it with a configuration profile." + } + ] + }, + { + "SettingName": "AutomaticLogoutEnabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatic logout must be enabled. Value discovered was {ActualValue}.", + "Description": "Configure automatic logout so inactive sessions are terminated instead of remaining open indefinitely." + } + ] + }, + { + "SettingName": "AutomaticLogoutSeconds", + "Operator": "LessEquals", + "DataType": "Int64", + "Operand": 86400, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Automatic logout must be 86400 seconds or less. Value discovered was {ActualValue}.", + "Description": "Reduce the automatic logout delay or enforce it with a profile." + } + ] + }, + { + "SettingName": "SshPasswordAuthenticationDisabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "SSH password authentication must be disabled. Value discovered was {ActualValue}.", + "Description": "Disable PasswordAuthentication and KbdInteractiveAuthentication in sshd configuration." + } + ] + }, + { + "SettingName": "FailedLoginAttemptsMaximum", + "Operator": "LessEquals", + "DataType": "Int64", + "Operand": 6, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Failed logon attempts must be limited to 6 or fewer. Value discovered was {ActualValue}.", + "Description": "Configure account lockout policy so brute-force attempts are limited." + } + ] + }, + { + "SettingName": "FailedLoginLockoutMinutes", + "Operator": "GreaterEquals", + "DataType": "Int64", + "Operand": 15, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Failed logon lockout time must be at least 15 minutes. Value discovered was {ActualValue}.", + "Description": "Increase the lockout duration after consecutive failed sign-in attempts." + } + ] + }, + { + "SettingName": "PasswordHistoryDepth", + "Operator": "GreaterEquals", + "DataType": "Int64", + "Operand": 5, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Password history must retain at least 5 previous passwords. Value discovered was {ActualValue}.", + "Description": "Configure password history so recent passwords cannot be reused." + } + ] + }, + { + "SettingName": "FirewallEnabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "The macOS Application Firewall must be enabled. Value discovered was {ActualValue}.", + "Description": "Enable the Application Firewall in macOS or enforce it with a profile." + } + ] + }, + { + "SettingName": "FirewallStealthModeEnabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Firewall stealth mode must be enabled. Value discovered was {ActualValue}.", + "Description": "Enable stealth mode so the Mac does not respond to probing requests." + } + ] + }, + { + "SettingName": "ScreenSharingDisabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Screen Sharing and Apple Remote Desktop must be disabled. Value discovered was {ActualValue}.", + "Description": "Disable the screen sharing service unless there is an approved remote support exception." + } + ] + }, + { + "SettingName": "PrinterSharingDisabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Printer sharing must be disabled. Value discovered was {ActualValue}.", + "Description": "Turn off printer sharing and clear shared-printer flags on local printers." + } + ] + }, + { + "SettingName": "GatekeeperEnabled", + "Operator": "IsEquals", + "DataType": "Boolean", + "Operand": true, + "MoreInfoUrl": "https://github.com/usnistgov/macos_security", + "RemediationStrings": [ + { + "Language": "en_US", + "Title": "Gatekeeper must be enabled. Value discovered was {ActualValue}.", + "Description": "Enable Gatekeeper so only trusted signed applications are allowed to run by default." + } + ] + } + ] +} diff --git a/policies/user-context/discovery.sh b/policies/user-context/discovery.sh new file mode 100644 index 00000000..9a2b36b4 --- /dev/null +++ b/policies/user-context/discovery.sh @@ -0,0 +1,41 @@ +#!/bin/bash + +read_jxa_preference() { + local suite="$1" + local key="$2" + + /usr/bin/osascript -l JavaScript 2>/dev/null <G=m`<*zPBT-bmuq~zw6_rG5ZN#@x=C)Pp0+cz>APOs zcG~az7rOu{$WCs$68`_+|NVde_kaKQTK=`eQ9!}--#X%xe}0UjeuXdUV^k8l&1D@$ z-J)1(h+=iDKBAk_59xK7Hbe|V1`^XlG>MHvMiQHbOe8iBnIWblmMQCym9#NN3Z`sB zHj*|)>{E^*N2V|5kdrkJxme4Po3*k9tnH3|sF1Y}c_t{<@g3bzQOK&NPEf4#D-`Rx zr&nfoFEiUAZ>H1@rG-zF7PF14=PUG33ERXLL0roESuez8Y%^O7aXH(%kE~YAZFN3wi@Cc>>joTVjsJgt%bOb z-N!Nz*R%WC9S}FL2Us7(JM;C*9%SpFtdV_&t%taY?P41s_J^9;omZPEinHjckY9y> zj+!;h8vKXi$4-QzA#PL%F(;$KOfAU1SI zXXA9|{`OrT4nZ^7G$3%{=(ucz@%Qib>tz$KWSGNIAv7N1;w=+`FwJ*$bc~0EiJ2?y zFtv^uJ{snQ@z}Kvm`sch@S)%g7ZzrZA|A><%$bN?4~&H)q3GyTC=hy82t|3ESO7Av zL_)HUpXG(n6tols7@rSJ#DqXF#sM@k-G$_)?R6rtAXy%?;;w~*A+0z6_L^5BGa(@s z6DD9Hqqx8T8|KNtPgH%f(@fPM!c~0?NT;TpH0iNYbgh&W}SYQ>=>Ato{n)si0z*NP#R#zWHSfJK$w+{ zLRf&z0$2p#62e?I!}cIn$TmJU!v#ZuX}|^9LR!pl5!oD!!Ct>AC>RqEW~W1(2?mqR zF-VO@p;LY$6p6@%Txcr9hLt@aT_k9zEIzi~QkbH4Fn+FkU<*)(}A^rmQU+FAI<8RgyOd81EBk&2}it8@j| zp!Sv@arQ&;KLv4SO@6cNIv?e8H=QfO!MqrhVo(NwY~n(rd@S0>)nZmX24qetE&nALWIRZEe35Z~@)W-;kd%d)XLhe>BPPff9=a!9JJS@V6% zmYEc)^|G&3Z`*DVg}=7NLv{p#vmz)C`39KiA6&|PAy#Mi!)&^#L6@r zp=oT%g{EU|*z!Z1eY`|%Elh-Y1`8Q1gtlfjG&VXD5x7>U=eNq1QEq&Cl;cCPvzr?y zhvFQ*ajl)UGwfudiSn;A?ZDkavw}P8aB+7vFsCyHkvjHD7$CPR+Y3> zrEE14T|-bYs9_q+09Qq@P=LheVd2wo@4jB$c{NVxvUn!y1jKdnsJscM7j*+vn1bCm z^nGfa5ysjM0?;g>XfVdY?cz7e^z7(VM7HvyW1&DKHp_Rv{ei_;47;kaZo1-hk_oQ2>b{IKlaKgofqdpX^mH zr~vXl0p;%EPC)x!`0))8%u#8_v4^MDdR|WUyu5nhk~I8E>Ow#oWm7#N>DZWL8<*(u z&j5u7Ab$&KPaZ(9Iu$!!)$zbXhx6CcfTY#}T+%=YxJ1J=$)kdh*UcJ4UA_?o+#;oJ zWu=z8n92m z-38!~1+U8PvC&B63h+LGOup>Ya!3sxX()paA@g!sa3U7tLji@8&zTuF02NQdkN>|A zz)`ci-+JN33k#Q0_8pJxjZ6J&w$`Mrb@}C#ZQmo?p$DG1W9zo!h2WjNt2QR>Du3)P zy>;T|i92Uf-sZV8>*m6Rws*a&=AHMuR;JeWpGfXMA-yn^+J9+vWOTLVO4?N=Rd*y^ zyQIB6KOT8_RvKWX&XD8^NtV#Bp>5r*#+!{&MQh5_c3)UE?@hZrQc*+FwNq+(QF6T~ zSzi2ARjXtvOP5#OExlbT?bw|v@0@qyjH2(dAJ|%cQ1IaB+MzSaLuaJE%c(=7tHJRP zc1@&! zOwYjWzU2bM8SFte46o>at~*8P2mu>`D=VQBbvN|as6W!((&?x-3jmd=e`UC?^XvKu zGw3(S`u1HQAjGbQqB4y)6OY|7%$$M=*2BmqzdFqwjn`#Ff&id<0CBDTFkx=^qwQLy zQE1B}0Ycl4o$v4O?Hdf7AL#9m zoB0_w#umYr!3RGeQn%js5F8V_d)xGh6>P$MBzvW*LYegViU8)E%N?ldeh zO9nZ-_X&3kMSYN#U8*<-A}wMOcLj5uL6BL)z*&U?S3|SBY`}0E)q{ZuKOBImaFft# z41W9{Kmglc;C!p;M$^K+uXk)EX+;|*%37ATl&)E7la|^g!_q*?;?KT2mbsLrbNl<6 zr7LOada&oAA!X?So_ND%DlyIVZ8|A;&Ab6b&4s$(?^-V^S>PA<+fTPRcsKUt7^=Ertl6AY@(-F}6_2jt7 zR)9(1+9;?{ws59Se&z}fQvVFV6`_U_!K?67IWe1~oc8wictbn$5<;3meN7CmY@mGCM|tM8?w|nb6H=CF2MvG`^>WkMBOvQJ zRQ=3ckqw|^1KFRH1C1{rY%|f$a8)o4R}4Xh&?{Fyhw2Uzd^4 zU>EoW+nU>#bo)~7`lXqqyLH}3D5>N%_8$e5?Nar({tC#ISg+Rbp4jU3b@`ehyEhn!q3XJGzBpio>r)cE3*P(;2!jFFm z0@yvXXCeH^T#M{Z}p##(3)@Zi-%LCO>3p?$

z z>8@1KZppqo?Q*Z%obzJJRwdC@%5G_^gK^yOBc$i65avqXq9$bw!+I0Ogh@2=&MbUI zyu9=vQDt@sNR=_KUPwE233K-3ismOJ@;tp8a(XxC?OmH?!XoCcVN`cEVa*xeB4jmA z8C>MtqUEzFL7w@Uvh&O7+xq0%0K2Vu+M9FQyI?2CBWSuR(K?Ar!EKL9JJofmaiTyh z5WH$-xIhY@*e#1#fZ~46sHin04_x^g%aO1NDCQ~omdQ#rosHEwh&J_XChVeBEWl<7 zM-D6;dEji%>D`gjgF`?jk36D7EYNy(=Fo6DFBVu;7$}#bsGZt`>vP){Y;DWh)c1s2 zK&`7XA4+tIZp3(DhnA;dwos?#QKDURtG7>fHx$T-PSGwjXmwqpQ(fbI`@PIP1$4&I z7ccLNWsE{O(i;&^Wn*w66ucUDLJg8)hzQ6b=ulmZy`v-e_0{y)M=T8p?1}~oL9Uwd%VNtkQY>o6% z(f6Og)MX6t8uS-#)1q_ZScKdqcM1a*gD+!1ruxq?h1Vt*gFtoy*U93g4R$89kl47< z>l%&LZeIcj9#1MrAzL3sBq_Wy6OOP%&E zw=d;7D_PDywimv2^2W)9ak%m4deaWiTNiI!TzEC*VCIf1?FLqDJC=*TSNUG${pu&% zW1X=(?5eHqz5O|*{VCUgWEuFir{tT$;_RB_9rV$hhT3Onas{I#tt?JfnDC0$gF32*IsVZ+i@C|h>} zK$qJeG^gCX>z<}%n87|$wQ9YhWx03dK&s-%jK(DNK=GHiB^xOw1@m0OM+eQw{1ing>1yUf^84x`k~8JLSYo z^lFIZ{tz1cNB9wW9TemHx*qKQVenzYzngr&es$m3lIM21OuIHWM`(P(duG|U75_?OtTORU=8k%p`ZT*KOX6* zqWbT;(X|j<+Obld&G0y|BqOMyhU5C-VOi&c$fu&A zQ4tRj$1`d~8;If)fe;@Y1rGHtF=@)yQB$Ik zb+ArS+x3otb&qRYhK_<3`DD*RBIz(NtITb#_JuL)dD@)VqIWc1IjH%*^py7A-?IIm z(7>DLg9|{t_}iL94Sqi*`S{(e%njI5+UMUHx7F?FxB`|Q#0L&ZSKON;zRU>IGeVP} zdF@jVld+c)R663T-|dT+GmP?9{~C!qI_evTxyBAAk-sSV^df;2one@1aQ_g-n8pUa zk@3}&Zhef%fDa2t=E;M^-PX%A@*S5hb@AXe5b7EkY3X1(#t$)k$16-n2gXc&M@OTq zODHRH;UUc+J1&O%7OwNj*$)qQ48xOe_QO6b@+IOW`KQQz8@g0RD-2DA1@L(R9oMK3 zsx#Rj8cwZL=2&1jT`5*^-!ni4C z-5N0czE8ajv$fHY#@5E16?jM~>_c{%+;?z&?;_m%3=E?r`FXnitAzQnxJ_Uxry zZO@Ff)H5R^hZtcZ6pbH6?&;{xP9_9a3&wYe%xr`Kr8T&?5T!A3T4G`Z&zLJS0y7>H zx|qzq$8FeNK`}74Fw9sue&7i>D44Q!LAg*+aESXCxPa^~6{v{zS|f)(7C_!XXEVwP zsF8^V2>Tt74ZHTR=o@neJh>FzwX6>S&j$@Y)z>j`8n-a+Vi@fVF^3NW;wjLKI|+YD z76&`q1jy5Qw1W*@>xj-oB8(_90yh)#`{MhwBgY05SYUN6Gm{74&i3c?`#5y5h`YCL z7UPSTkkzX?2(?FFyhwpj4gxYhzd=Dx4IGI^lEIxvn3!d2C<Z`p6yAGG2_m95Kz-y42!c)3sN8j#8dKd_%i=A9IEtk8dM|Gs_sOVW{-r1F

byPhPopfCag7k?X)K7pzGX zT&x!fTbI}TE9&#{MQ8!bcbP(NzH3vT?`j0W+@zzj$^aIa%1NBzwugnw{*GZ>#~SaL zR6!iB#7i`outi-MTsF|!U^&V6qAMC;PbdoZr+Du`D1_vM0b~MpQgPTpttkW6E+!0~ zm&CwJ+}s#2C4j)IxxF#tGhkT&M~-&jSS_c4f1Mc}2X=Lkc-`50fB`~}GqA@3=Gq1n z@5VkLpR(mFs_uY(%a$GxsRu!Nmdzv&aNTw$#)VFTLHRuR<9YhC;|-9*1yk>b`SE@; z_dS4ta$>SVGz!*oVNdVzZj^t|ob3mTSl{upihyh2zK_L5Tp&*l%~r13Ma~8(Rd~<8 zgzCk>YVj!H0`umppX>dFyJDVJF}}9$u6SEaSM5w!F?aiJ_oXXq?;gH=I1TxU+lfcD z-K)F0!FbWon%>c{w&Or@$ANTX^dmD}T(V&>HF`dBI2_KuH@E=X4OC&}hL3W17tTvL zh?(K*VE7!5pD}nLTrJ7o8sy_&fIZiNr%$FY;KK5HqJhR4km$ZqW#hp!mjdJK;Cp%w zje+3e^D20{24YvagYc>lF+KMT7MY`=>qw3O5zu=I*?r^GRW{7Y1=qnDHbi`Xz^3vn zsZ5NH;CF@d$&e-Pr`RP1EeP%wNC3EL%hyhQ`P3R+oTQ5v+2uirE?%WOG5hS7&n}!; z8eb9S&VHaO(`jg=KFCIrGu#T@DV8B*Vd3kaGGHLre=J6aR^G!dnqxpN&1B0yx z7TdtOw6?%#!+T-QyN4}ey)erh_M0uvrv}Wbtbt0D^l=CY<>u;EeX`llcghBOLEQF; zW43CHY>$`M)iK##rel$CaFzia0k=CNiQikx=sZatqgd7 z!|M8Hq6!oh+6iWVaH&%WwBia7i!wpbvB3!o0~v2_MqkV3=8GXnw#Q$|41jI||9=PQ zi$VX&kv9Br6aAad)WOO}G!D29<4Wmj26@snKY7EChDBe+@0r;SctIJ7-d& zC=fO64X}cvEbvEb&}0`Fgf;Gv#0W_=A z5a^f`8(|zs9jhmyfrK=Mpnn3I|3sOQjHBHJ}F@T@@%UDuWB8zer5YJPoffP+mn_1)i#rwbtqdEbt38w3>GJ_D2?ew zlSn>vcyoeAHq!=r1{Y{|>^TrIOd>_!_GE1>>WDqmf??$6024Pq@Jr<|24hC>H)UyANyjz^_QmKT_d1r9upL{70}l zZ_ezzd1vQQXQRxHEmGeT#bW*z^p;WHgi)-bDPP~Bc9AAZ#1g(yESl8pTv>2t?OZu? z)mnj`N6~ zeDf5`b4C~QuVqV}KcJ~M|AOFY1zVD+WJ>|(bR)X}UR9z8wBMx}?KfCb6QyG5WRp6R zY%Erxo)6rkio{aTh?me*qB>D3w5T=2YN1t4tMiAQ|6kB!jabQ+#o@fe$mNi(c$;P` z#VTOx=tQkpDAp3Z17+54gLguQI*Q1!RoGJ4t>x6Ha8YLf6e3e=a*tXo8?)7FeGt=f z`>i4U?o(?D2h^099U((&vmI^JG6_O%D8>8Tfap^|CR*+)bSGUDRl(3Zc)Vi|md&IXB3g|Az()dvg!4!C>*tcOqGz z+VfM&>(ufbsA&`;Cr_giIe8UoTd{(zzhh49$l04hcKhD!P-|zQxut%?R%{T9V8?u! z69c%H@QJ?3JUa%thqL>qrXcsIn$E_M`&{--O|d)g(6H|SMX)((@OsKD8_6t>scps2 zzYVk=x8DXi*pYwlw7tntYOe}GamW28jY4K+R$E@&bmi>W@4U0DKNsIbd%h9aX3+&g zTT8xiAip&yU&Eqp`5Goce%m|RU7&+I`^|Mamuk>#`!+nu@;(|Qa`4K?c3^#W*JQ7{ zXW3ZP_#Ac@S|PK0KC9XwORqnf@_}7)H#ny9Tu`R*BSP*uXw3Z>0@xRZ-9N2SNWk!wtAZn61 zGVrM~sM}^hy9SQl+drJk7>KzMgdKXg5siAB$j)t`L+@m{AmqmFs@LRfJ3kTrA8@n8 ziTfkpj)sc3LzTeDD||L#QDM&g3_GpBK!QNFXTC#5O&t&JdSBmCOjJ0EqYL_}f)?&q zSdMHlhZ$TF1Jo(QcOxL>5pkLO8+ebG0(2AHXZ*k~wH2bAN};3?g$mPG5$diW@M{!yei*_@%(4Mg>7z z28lsc*{0T*Vij?>4t4XO_u}Dm@QE2A9D&(R30x?|{WXjNndIwZ&?%0?hh5}5HN~y* zG?vo%VK+K6!WT5~F>e4=o_J7Ynp6f}lTyI@Jxn3PM0{NoH*b_llx_J#NXecv-4}?J zWFT;^w?A;MyMIton*AA;f^!pmZcJ?D++SitbR^jB&V$e-(zGJC*Wq`0)3E?*3uG&v z^h}cM4SXfeWd(blycQ_-6Oy)N0HqXQ6L7NvKLrIro>PaH9opi_SAOaaz);tD*`anq zY#G_%$YZcL}ItXxZz))~p>DEG;Ak+#~yaI=QMeTv= zc7dDa>!5Em#eB}ActTlJ(#jRUX}$nIzSBtbqVDp=-lTiS(($CbdHJQJd(X;v(tTv^ zWZGN3WK4P+mQ6`-`$`FXSNfnO>Fs^rob;ZZJCiP~kg7YA=-!j|R4$GsJ@s>^9-9l- z%w-Qs-9al^4NxoX*wrk!iFH%WUJ2bX)m$!e9}{rF(l+>7h(l7-n@uit!q z=~eKR{h53BJiYEJTl9YYbx5Ed<<`W_iACWX(MKh_m+9|W-?OGXo%81PGVo+tt7=VF zwJu*wRUJr`9b7AWE?M^6L+?XARd#CL0V?yQ5vgX+e8IwjN0!PBD^=LJVW*l~=T3jD zHy4}c&V1sbDwrk58q=9%I#&*+n8R!3N9G;tMOBL6)gy(c4k@8mwmDg6-#}zO=Vt&D)yvwyu{o-Zw0txMyF9JbYey z;ftvd0 zsj7?b#g^EI-k((cs7m_6g;e*2KOS6;&7YB~F0Pj|OVz8pp8r|-u?1rqoX@_PbTbRK zbWPpTsTG4%w|Av`WqjqLRQ2qFHC@@fd@)(Mf5DP=m)&ySbS?=i?1FREedyQjip7IV z(PZV`A6$LdklO#ks{3RbbZ&jg!sa#i?xcJ7O2exA;5w-mNmh3L;KUElzTcZV+@IPz zu<9O!g0#14@pZuAb#LY4rhV!9wsd3ry1#Y#{Jn~wA3v39J^iE51F#2tZ}{Hu!%(vI z^hY*RdBvu|Qe5(h(N^f$D5DBXZrN|zA2a@RUGsWF({k~5hSr(7r5D!f4<_pmJ}6Js zA4@SkYs~2+bNc;3Y2c+4^YTYlV{ysf8_b2Ck6WmU9v#B4Y2$evRlYM_T#Z)ErN&fo zbGot)Z9L14ROSA4U&B%?<=ekr-zYUbldA7pFRxlW|8_;XxZ)$1rMdvH2+-DAwD9aw zAX&8c2jkMwv#I^(RxMvxw|LU_N~val(!PJ)Ui6Wh^6lAlSqeQLIU%)Z+^|t~P2X+% zR$CgPBi}lb-r2IY^FVUvfwZsjyRF}9-Nebl0rBmDfeJmF2DFqim)qMZN%IQ>V_bUDTI_;c)O{zYUbRBsh z{QKE|JNtfh>e-j2p;wa6zVZPb_|3;7da8Oz_nVLFskSo^?FHD7FZ2G&>K&}H{8bGN z;ZLnagLPGZfIx?Ij4dr9oltd;IbmhMTF?)$O#A^Vf)kD{sW z^K0EB$?lObn0``Hq1`I6% zmr0NKEeeZNguN243z90yGl(f?5adR(llZhC+ao}GNGptCs!*MkGFKCal9Cg1`2`*s_v;Rf^OnA38aLZtpvVhk2qH9)6p>R%3dM&k;;36d4i7min^;a#3cBH-`pgnA z-6ER<0T6cKuZqAQ{27}8)P}z>!T|}PxDE_%K>$)T$}-pR{X=}W;dcb&uTg;)0*yKF zmq>((NcajFOE$sh1Yq`4;MIlA&S0>C!B;W(3k+VtfCvdhaM*{h-58v}U;u;57))X? zjX@0tuVZin10sH)Y@vt^cQJ*+gd#xv6jN&$AooeA0mtBLJq8UJ?1VtJ99I6$(NV4f z>cM}CXCd4$=ybZjrB41G<@*)o`UPbp|E<5E9KWP?{E{mBB~|h(%J$e@GUrGamr9f; zUElhkG+Ev)Q6*_FgoPjLO+LLu)ogeuz3qSMZMw=03W7}oyl#-!DpEk}+#3`GnF35X zExOvx61}c-vp}bt&}~`@btRikCY@)~+o3bTUohG*Kn#EK zXu}9GFl3(M4Kt=JR7v@U6;lP2t$f3VDLZ9q*mOW@lZ9nAY+7`>FTgN5-9ZcvZCakw z>8du5>x&?4)$5LI6g23n(na9(0r6v-bHfO6W(-VOC|C7{6;lP2$+~HS)aE(ealP)c gZnK}(>qd1@K-=fzj|}BMr!BvC9Na}Re`e|b0kL6cbN~PV literal 0 HcmV?d00001 diff --git a/scripts/generate_baselines.py b/scripts/generate_baselines.py new file mode 100644 index 00000000..0eab9107 --- /dev/null +++ b/scripts/generate_baselines.py @@ -0,0 +1,487 @@ +#!/usr/bin/env python3 +"""Generate Intune custom compliance assets from mSCP macOS baselines.""" + +from __future__ import annotations + +import argparse +import json +import math +import re +import shutil +from dataclasses import dataclass +from pathlib import Path +from typing import Any + +import yaml + +MACOS_VERSION = "26.0" +MAX_RULES_PER_PART = 90 +SUPPORTED_RESULT_TYPES = {"string": "String", "integer": "Int64"} +DEFAULT_MORE_INFO = "https://github.com/usnistgov/macos_security" +EXPLICIT_USER_CONTEXT_RULE_IDS = { + "os_show_filename_extensions_enable", + "system_settings_bluetooth_sharing_disable", + "system_settings_hot_corners_secure", + "system_settings_location_services_disable", + "system_settings_location_services_enable", +} + + +@dataclass +class SupportedRule: + rule_id: str + title: str + discussion: str + section: str + source_path: str + rule_url: str + context: str + data_type: str + operand: Any + shell: str + remediation_title: str + + +@dataclass +class UnsupportedRule: + rule_id: str + section: str + source_path: str + reason: str + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser() + parser.add_argument("--mscp-root", required=True, help="Path to local mSCP clone") + parser.add_argument( + "--repo-root", + default=str(Path(__file__).resolve().parents[1]), + help="Path to this repo root", + ) + return parser.parse_args() + + +def load_yaml(path: Path) -> dict[str, Any]: + data = yaml.safe_load(path.read_text(encoding="utf-8")) + return data if isinstance(data, dict) else {} + + +def rule_url_from_source(source_path: str) -> str: + return f"https://github.com/usnistgov/macos_security/blob/main/{source_path.replace(chr(92), '/')}" + + +def choose_macos_enforcement(rule: dict[str, Any]) -> tuple[dict[str, Any] | None, str | None]: + mac = ((rule.get("platforms") or {}).get("macOS") or {}) + if not isinstance(mac, dict): + return None, None + + version_block = mac.get(MACOS_VERSION) + if isinstance(version_block, dict) and isinstance(version_block.get("enforcement_info"), dict): + return version_block["enforcement_info"], f"platforms.macos.{MACOS_VERSION}.enforcement_info" + + if isinstance(mac.get("enforcement_info"), dict): + return mac["enforcement_info"], "platforms.macos.enforcement_info" + + for fallback_version in ("15.0", "14.0"): + fallback_block = mac.get(fallback_version) + if isinstance(fallback_block, dict) and isinstance(fallback_block.get("enforcement_info"), dict): + return fallback_block["enforcement_info"], f"platforms.macos.{fallback_version}.enforcement_info" + + return None, None + + +def context_for_rule(rule_id: str, shell: str, discussion: str) -> str: + text = f"{shell}\n{discussion}" + if rule_id in EXPLICIT_USER_CONTEXT_RULE_IDS: + return "user" + if any(token in text for token in ("CURRENT_USER", "sudo -u", "-currentHost", "last logged in user")): + return "user" + return "root" + + +def resolve_odv(rule: dict[str, Any], baseline_parent: str) -> str | None: + odv = rule.get("odv") + if not isinstance(odv, dict): + return None + + candidate_keys = [ + baseline_parent, + baseline_parent.replace("-", "_"), + baseline_parent.replace("_macos_26.0", ""), + baseline_parent.replace("_macos_26.0", "").replace("-", "_"), + "recommended", + ] + for key in candidate_keys: + if key in odv: + return str(odv[key]) + return None + + +def substitute_odv(text: str, odv_value: str | None) -> str: + if "$ODV" not in text: + return text + return text.replace("$ODV", odv_value or "0") + + +def remediation_title(rule_title: str, operand: Any) -> str: + title = rule_title.strip().replace("$ODV", str(operand)) + title = re.sub(r"\s+", " ", title) + if len(title) > 150: + title = title[:147].rstrip() + "..." + return f"{title}. Value discovered was {{ActualValue}}." + + +def normalize_operand(result_value: Any, result_type: str) -> Any: + if result_type == "integer": + if isinstance(result_value, int): + return result_value + if isinstance(result_value, str) and result_value.strip(): + return int(str(result_value).strip()) + return 0 + return str(result_value) + + +def build_rule_record( + rule_id: str, + section: str, + source_path: str, + baseline_parent: str, + rule: dict[str, Any], +) -> SupportedRule | UnsupportedRule: + enforcement_info, _ = choose_macos_enforcement(rule) + if not enforcement_info: + return UnsupportedRule(rule_id, section, source_path, "No macOS enforcement_info") + + check = enforcement_info.get("check") + if not isinstance(check, dict): + return UnsupportedRule(rule_id, section, source_path, "No check block") + + shell = check.get("shell") + result = check.get("result") + if not isinstance(shell, str) or not shell.strip(): + return UnsupportedRule(rule_id, section, source_path, "No shell check") + if not isinstance(result, dict) or not result: + return UnsupportedRule(rule_id, section, source_path, "No result metadata") + + result_type = next(iter(result.keys())) + if result_type not in SUPPORTED_RESULT_TYPES: + return UnsupportedRule(rule_id, section, source_path, f"Unsupported result type: {result_type}") + + odv_value = resolve_odv(rule, baseline_parent) + rendered_shell = substitute_odv(shell.rstrip(), odv_value) + raw_operand = result[result_type] + if isinstance(raw_operand, str): + raw_operand = substitute_odv(raw_operand, odv_value) + operand = normalize_operand(raw_operand, result_type) + title = str(rule.get("title") or rule_id) + discussion = str(rule.get("discussion") or "") + + return SupportedRule( + rule_id=rule_id, + title=title, + discussion=discussion, + section=section, + source_path=source_path, + rule_url=rule_url_from_source(source_path), + context=context_for_rule(rule_id, rendered_shell, discussion), + data_type=SUPPORTED_RESULT_TYPES[result_type], + operand=operand, + shell=rendered_shell, + remediation_title=remediation_title(title, operand), + ) + + +def slugify_baseline(name: str) -> str: + return name.replace(".yaml", "") + + +def chunked(items: list[SupportedRule], size: int) -> list[list[SupportedRule]]: + return [items[index : index + size] for index in range(0, len(items), size)] + + +def to_json(obj: Any) -> str: + return json.dumps(obj, indent=2, ensure_ascii=True) + + +def bash_escape(value: str) -> str: + return value.replace("\\", "\\\\").replace('"', '\\"') + + +def make_script(part_rules: list[SupportedRule]) -> str: + lines: list[str] = [ + "#!/bin/bash", + "", + "normalize_output() {", + " local value=\"$1\"", + " value=${value//$'\\r'/ }", + " value=${value//$'\\n'/ }", + " value=${value//$'\\t'/ }", + " printf '%s' \"$value\" | /usr/bin/sed -E 's/[[:space:]]+/ /g; s/^ //; s/ $//'", + "}", + "", + "json_escape() {", + " local value=\"$1\"", + " value=${value//\\\\/\\\\\\\\}", + " value=${value//\\\"/\\\\\\\"}", + " printf '%s' \"$value\"", + "}", + "", + "emit_separator=\"\"", + "", + "emit_string_field() {", + " local name=\"$1\"", + " local value=\"$2\"", + " printf '%s\"%s\":\"%s\"' \"$emit_separator\" \"$name\" \"$(json_escape \"$value\")\"", + " emit_separator=','", + "}", + "", + "emit_int_field() {", + " local name=\"$1\"", + " local value=\"$2\"", + " if [[ ! \"$value\" =~ ^-?[0-9]+$ ]]; then", + " >&2 echo \"[$name] expected integer output but got: $value\"", + " value=0", + " fi", + " printf '%s\"%s\":%s' \"$emit_separator\" \"$name\" \"$value\"", + " emit_separator=','", + "}", + "", + "printf '{'", + ] + + for index, rule in enumerate(part_rules, start=1): + func_name = f"run_check_{index:03d}" + delimiter = f"__MSCP_RULE_{index:03d}__" + lines.extend( + [ + "", + f"# {rule.rule_id}", + f"{func_name}() {{", + f" /bin/bash <<'{delimiter}'", + rule.shell, + delimiter, + "}", + f"raw_output=\"$({func_name} 2>/dev/null || true)\"", + "normalized_output=\"$(normalize_output \"$raw_output\")\"", + ] + ) + if rule.data_type == "Int64": + lines.append(f"emit_int_field \"{rule.rule_id}\" \"$normalized_output\"") + else: + lines.append(f"emit_string_field \"{rule.rule_id}\" \"$normalized_output\"") + + lines.extend(["", "printf '}'", ""]) + return "\n".join(lines) + + +def make_rules_json(part_rules: list[SupportedRule]) -> dict[str, Any]: + rules: list[dict[str, Any]] = [] + for rule in part_rules: + rules.append( + { + "SettingName": rule.rule_id, + "Operator": "IsEquals", + "DataType": rule.data_type, + "Operand": rule.operand, + "MoreInfoUrl": rule.rule_url or DEFAULT_MORE_INFO, + "RemediationStrings": [ + { + "Language": "en_US", + "Title": rule.remediation_title, + "Description": "See the linked mSCP rule for implementation and remediation guidance.", + } + ], + } + ) + return {"Rules": rules} + + +def write_text(path: Path, content: str) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text(content, encoding="utf-8", newline="\n") + + +def render_baseline_readme( + baseline_name: str, + title: str, + description: str, + manifest: dict[str, Any], +) -> str: + lines = [ + f"# {baseline_name}", + "", + title, + "", + description.strip() if description.strip() else "Generated Intune custom compliance assets for this mSCP baseline.", + "", + "## Generated policy parts", + "", + ] + + for part in manifest["parts"]: + lines.extend( + [ + f"- `{part['name']}` - context: **{part['context']}**, rules: **{part['ruleCount']}**", + ] + ) + + lines.extend( + [ + "", + "## Notes", + "", + f"- Supported rules generated: **{manifest['supportedRuleCount']}**", + f"- Unsupported rules skipped: **{manifest['unsupportedRuleCount']}**", + "- Use one Intune custom compliance policy per part.", + "- For `user` context parts, set **Run this script using the logged on credentials** to **Yes**.", + "- For `root` context parts, set **Run this script using the logged on credentials** to **No**.", + "", + ] + ) + return "\n".join(lines) + + +def generate(repo_root: Path, mscp_root: Path) -> None: + rules_dir = mscp_root / "src" / "mscp" / "data" / "rules" + baselines_dir = mscp_root / "src" / "mscp" / "data" / "baselines" / "macos" + output_dir = repo_root / "generated-baselines" + summary_dir = repo_root / "docs" + + if output_dir.exists(): + shutil.rmtree(output_dir) + output_dir.mkdir(parents=True, exist_ok=True) + + rule_index: dict[str, tuple[dict[str, Any], str]] = {} + for path in sorted(rules_dir.rglob("*.yaml")): + data = load_yaml(path) + rule_id = str(data.get("id") or path.stem) + relative_path = str(path.relative_to(mscp_root)).replace("\\", "/") + rule_index[rule_id] = (data, relative_path) + + summary_rows: list[dict[str, Any]] = [] + summary_lines = [ + "# Generated baseline summary", + "", + "These assets were generated from the mSCP macOS 26.0 baseline files.", + "", + "| Baseline | Supported rules | Unsupported rules | Policy parts |", + "| --- | ---: | ---: | ---: |", + ] + + for baseline_path in sorted(baselines_dir.glob("*.yaml")): + baseline = load_yaml(baseline_path) + baseline_name = slugify_baseline(baseline_path.name) + baseline_parent = str(baseline.get("parent_values") or baseline_name) + baseline_folder = output_dir / baseline_name + baseline_folder.mkdir(parents=True, exist_ok=True) + + supported_rules: list[SupportedRule] = [] + unsupported_rules: list[UnsupportedRule] = [] + + for section in baseline.get("profile", []): + section_name = str(section.get("section") or "Uncategorized") + for rule_id in section.get("rules", []): + rule_record = rule_index.get(rule_id) + if not rule_record: + unsupported_rules.append( + UnsupportedRule(str(rule_id), section_name, "", "Rule file not found in local mSCP clone") + ) + continue + rule, source_path = rule_record + record = build_rule_record(str(rule_id), section_name, source_path, baseline_parent, rule) + if isinstance(record, SupportedRule): + supported_rules.append(record) + else: + unsupported_rules.append(record) + + parts: list[dict[str, Any]] = [] + part_number = 0 + for context in ("root", "user"): + context_rules = [rule for rule in supported_rules if rule.context == context] + for chunk in chunked(context_rules, MAX_RULES_PER_PART): + part_number += 1 + part_name = f"part-{part_number:02d}-{context}" + part_dir = baseline_folder / part_name + part_dir.mkdir(parents=True, exist_ok=True) + + write_text(part_dir / "discovery.sh", make_script(chunk)) + (part_dir / "discovery.sh").chmod(0o755) + write_text(part_dir / "rules.json", to_json(make_rules_json(chunk))) + write_text( + part_dir / "manifest.json", + to_json( + { + "baseline": baseline_name, + "part": part_name, + "context": context, + "ruleCount": len(chunk), + "settingNames": [rule.rule_id for rule in chunk], + } + ), + ) + parts.append( + { + "name": part_name, + "context": context, + "ruleCount": len(chunk), + "path": str(part_dir.relative_to(repo_root)).replace("\\", "/"), + } + ) + + baseline_manifest = { + "baseline": baseline_name, + "title": baseline.get("title"), + "description": baseline.get("description"), + "supportedRuleCount": len(supported_rules), + "unsupportedRuleCount": len(unsupported_rules), + "partCount": len(parts), + "parts": parts, + } + write_text(baseline_folder / "manifest.json", to_json(baseline_manifest)) + write_text( + baseline_folder / "unsupported-rules.json", + to_json( + [ + { + "ruleId": entry.rule_id, + "section": entry.section, + "sourcePath": entry.source_path, + "reason": entry.reason, + } + for entry in unsupported_rules + ] + ), + ) + write_text( + baseline_folder / "README.md", + render_baseline_readme( + baseline_name=baseline_name, + title=str(baseline.get("title") or baseline_name), + description=str(baseline.get("description") or ""), + manifest=baseline_manifest, + ), + ) + + summary_rows.append( + { + "baseline": baseline_name, + "supportedRuleCount": len(supported_rules), + "unsupportedRuleCount": len(unsupported_rules), + "partCount": len(parts), + } + ) + summary_lines.append( + f"| `{baseline_name}` | {len(supported_rules)} | {len(unsupported_rules)} | {len(parts)} |" + ) + + write_text(output_dir / "summary.json", to_json(summary_rows)) + write_text(summary_dir / "baseline-generation-summary.md", "\n".join(summary_lines) + "\n") + + +def main() -> None: + args = parse_args() + generate(repo_root=Path(args.repo_root).resolve(), mscp_root=Path(args.mscp_root).resolve()) + + +if __name__ == "__main__": + main()