search

SummitRoute / osxlockdown

[No longer maintained] Apple OS X tool to audit for, and remediate, security configuration settings.
MIT License
776 stars 51 forks source link

Disable "Install system data files and security updates" #34

Open ghost opened 8 years ago

ghost commented 8 years ago

"Install system data files and security updates" may be a threat to privacy according to https://medium.com/@sabrihaddouche/automatic-updates-of-kernel-extensions-in-os-x-9b75b3e45c97

Recommendation: Disable it.

advantgroup commented 8 years ago

+1. What was shove/AppleKextExcludeList.kext anyway?

ghost commented 8 years ago

Hello @lolomet,

Shove is a part of the PackageKit.framework which is used to update OS X files, it has been triggered by softwareupdated.

For the .kext:

Its name is AppleKextExcludeList.kext which basically include a blacklist (.plist) for kexts with known issues.

matteocng commented 8 years ago

This is the setting: defaults read /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall