Open iamflaurian opened 1 day ago
@iamflaurian how are you running this command?
Hey @golbiga
I add the command in various formats into a script that will be deployed using Jamf Pro. I did not touch it because it worked before updating the macOS versions. Please note, I test it also by using the command in terminal or in other various formats.
NoWorldWriteableFilesExistLibary=$(find /System/Volumes/Data/Library -type d -perm -2 -ls | grep -v Caches | grep -v /Preferences/Audio/Data | wc -l | xargs)
if [ "$NoWorldWriteableFilesExistLibary" != 0 ];
then
IFS=$'\n'
for libPermissions in $( find /System/Volumes/Data/Library -type d -perm -2 | grep -v Caches | grep -v /Preferences/Audio/Data );
do
chmod -R o-w "$libPermissions"
printf "Set permissions for 5.1.7 Ensure No World Writable Files Exist in the Library\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
done
else
printf "5.1.7 Ensure No World Writable Files Exist in the Library has already the permissions\n" "$(date "+%Y-%m-%d %H:%M:%S")" "${ScriptName}"
fi
os_world_writable_library_folder_configure.yaml blocked by SIP
Steps to reproduce
I tried to set the "Ensure No World Writable Files Exist in the Library" by using the command from JCE with MDM (Script) and via terminal.
IFS=$'\n' for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do /bin/chmod -R o-w "$libPermissions" done
Operating System version
14.7.1 / 15.1 tested it on three different machines
Intel or Apple Silicon
Its just possible for me to test it with Apple Silicon devices
What is the current bug behavior?
For me its seems like its blocked by SIP (System Integrity Protection)
What is the expected correct behavior?
The command should set "0"
Relevant logs and/or screenshots
find: /System/Volumes/Data/Library/Trial: Operation not permitted find: /System/Volumes/Data/Library/Management/Files/ProtectSudoersFile: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.amsengagementd.classicdatavault: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.aneuserd: Operation not permitted find: /System/Volumes/Data/Library/Caches/com.apple.iconservices.store: Permission denied find: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted