usnistgov / macos_security

macOS Security Compliance Project
Other
1.8k stars 203 forks source link

os_world_writable_library_folder_configure.yaml blocked by SIP? #445

Open iamflaurian opened 3 weeks ago

iamflaurian commented 3 weeks ago

os_world_writable_library_folder_configure.yaml blocked by SIP

Steps to reproduce

I tried to set the "Ensure No World Writable Files Exist in the Library" by using the command from JCE with MDM (Script) and via terminal.

IFS=$'\n' for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do /bin/chmod -R o-w "$libPermissions" done

Operating System version

14.7.1 / 15.1 tested it on three different machines

Intel or Apple Silicon

Its just possible for me to test it with Apple Silicon devices

What is the current bug behavior?

For me its seems like its blocked by SIP (System Integrity Protection)

What is the expected correct behavior?

The command should set "0"

Relevant logs and/or screenshots

find: /System/Volumes/Data/Library/Trial: Operation not permitted find: /System/Volumes/Data/Library/Management/Files/ProtectSudoersFile: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.amsengagementd.classicdatavault: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.aneuserd: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.iconservices.store: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted

golbiga commented 3 weeks ago

@iamflaurian how are you running this command?

iamflaurian commented 3 weeks ago

Hey @golbiga

I add the command in various formats into a script that will be deployed using Jamf Pro. I did not touch it because it worked before updating the macOS versions. Please note, I test it also by using the command in terminal or in other various formats.

NoWorldWriteableFilesExistLibary=$(find /System/Volumes/Data/Library -type d -perm -2 -ls | grep -v Caches | grep -v /Preferences/Audio/Data | wc -l | xargs)

if [ "$NoWorldWriteableFilesExistLibary" != 0 ];
then
    IFS=$'\n'
    for libPermissions in $( find /System/Volumes/Data/Library -type d -perm -2 | grep -v Caches | grep -v /Preferences/Audio/Data );
    do
    chmod -R o-w "$libPermissions"
    printf "Set permissions for 5.1.7 Ensure No World Writable Files Exist in the Library\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
    done
else
    printf "5.1.7 Ensure No World Writable Files Exist in the Library has already the permissions\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
fi
golbiga commented 3 weeks ago

@iamflaurian so this is a CIS issue, I've let some folks know, but I would recommend opening a ticket with them (create an account on https://workbench.cisecurity.org - if you don't have one)

iamflaurian commented 2 weeks ago

Does it mean, CIS has to remove these rule because of SIP block? I'll create an account and also a ticket :) Thanks @golbiga

golbiga commented 2 weeks ago

@iamflaurian actually we needed to update something on our side, which I will take care of today. We need to add 2>&1 to the find command.

iamflaurian commented 2 weeks ago

Hey @golbiga first of all, pretty appreciated you for answering my question. I would like add 2>&1 in find command will give the result "11" but does not mean the execution command to set the rule will set $libPermissions. (JFI: Ticket is already open)