mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 08:58:41 +00:00
CIS_MAC13_2.8.1 (#10192)
This commit is contained in:
Sharon Katz
GitHub
parent
a2e8a787c9
commit
2295575fdb
3 changed files with 130 additions and 0 deletions
|
|
@ -902,6 +902,62 @@ spec:
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Universal Control is enabled (Based on organization's policy) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Universal Control is an Apple feature that allows Mac users to control multiple other Macs and iPads with the same keyboard, mouse, and trackpad using the same Apple ID. The technology relies on already available iCloud services, particularly Handoff.
|
||||
Universal Control simplifies the use of iCloud connectivity of multiple computers using the same Apple ID. This may simplify data transfer from organizationally-managed and personal devices. The use of the same iCloud account and Handoff is the underlying concern that should be evaluated. The use of the same keyboard or mouse across multiple devices does not by itself decrease organizational security.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The `PayloadType` string is com.apple.universalcontrol.
|
||||
2. The key to include is 'Disable'.
|
||||
3. The key must be set to <false/>.
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.universalcontrol'
|
||||
AND
|
||||
name='Disable'
|
||||
AND value = '0';
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.8.1-enabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Universal Control is disabled (Based on organization's policy) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Universal Control is an Apple feature that allows Mac users to control multiple other Macs and iPads with the same keyboard, mouse, and trackpad using the same Apple ID. The technology relies on already available iCloud services, particularly Handoff.
|
||||
Universal Control simplifies the use of iCloud connectivity of multiple computers using the same Apple ID. This may simplify data transfer from organizationally-managed and personal devices. The use of the same iCloud account and Handoff is the underlying concern that should be evaluated. The use of the same keyboard or mouse across multiple devices does not by itself decrease organizational security.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The `PayloadType` string is com.apple.universalcontrol.
|
||||
2. The key to include is 'Disable'.
|
||||
3. The key must be set to <true/>.
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.universalcontrol'
|
||||
AND
|
||||
name='Disable'
|
||||
AND value = '1';
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.8.1-disabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Power Nap Is Disabled for Intel Macs (Fleetd Required)
|
||||
platforms: macOS
|
||||
|
|
|
|||
37
ee/cis/macos-13/test/profiles/2.8.1.disable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.8.1.disable.mobileconfig
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.universalcontrol</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.8.1.check-disabled</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>A6481AEB-354C-4718-9E01-B4562C7F341A</string>
|
||||
<key>Disable</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Ensure Universal Control is disabled</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.8.1-disabled</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>8EA6B5B4-A0EF-49B3-8A6E-C8F02C27456B</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
37
ee/cis/macos-13/test/profiles/2.8.1.enable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.8.1.enable.mobileconfig
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.universalcontrol</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.8.1.check-enabled</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>F39058CB-027B-453D-B2DF-414F9B84D241</string>
|
||||
<key>Disable</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Ensure Universal Control is enabled</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.8.1-enabled</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>ECC41516-FFD8-4321-9696-63B1939CB956</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
Loading…
Reference in a new issue