From 58b8d65b6f4b95029b288aa41967e1f2ff8a140f Mon Sep 17 00:00:00 2001 From: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com> Date: Wed, 15 Mar 2023 16:40:54 -0400 Subject: [PATCH] MAC CIS 13 2.5.1 (#10168) --- ee/cis/macos-13/cis-policy-queries.yml | 290 ++++++++++++++++++ .../test/profiles/2.5.1-disable.mobileconfig | 37 +++ .../test/profiles/2.5.1-enable.mobileconfig | 37 +++ 3 files changed, 364 insertions(+) create mode 100644 ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig create mode 100644 ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig diff --git a/ee/cis/macos-13/cis-policy-queries.yml b/ee/cis/macos-13/cis-policy-queries.yml index 4c5edd5944..f18af5b701 100644 --- a/ee/cis/macos-13/cis-policy-queries.yml +++ b/ee/cis/macos-13/cis-policy-queries.yml @@ -802,6 +802,296 @@ spec: --- apiVersion: v1 kind: policy +spec: + name: CIS - Ensure Siri is enabled (Based on organization's policy) (MDM Required) + platforms: macOS + platform: darwin + description: | + With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case. + In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements. + Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times, and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity. + resolution: | + Automated method: + Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar. + Create or edit a configuration profile with the following information: + 1. The `PayloadType` string is com.apple.applicationaccess. + 2. The key to include is allowAssistant. + 3. The key must be set to . + query: | + SELECT 1 FROM managed_policies WHERE + domain='com.apple.applicationaccess' + AND + name='allowAssistant' + AND (value = '1' OR value = 'true'); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-enabled, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri is disabled (Based on organization's policy) (MDM Required) + platforms: macOS + platform: darwin + description: | + With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case. + In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements. + Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times, and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity. + resolution: | + Automated method: + Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar. + Create or edit a configuration profile with the following information: + 1. The `PayloadType` string is com.apple.applicationaccess. + 2. The key to include is allowAssistant. + 3. The key must be set to . + query: | + SELECT 1 FROM managed_policies WHERE + domain='com.apple.applicationaccess' + AND + name='allowAssistant' + AND (value = '0' OR value = 'false'); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-disabled, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field TypeToSiriEnabled is true (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri TypeToSiriEnabled field is true. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool true + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'TypeToSiriEnabled' AND + value = '1') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-TypeToSiriEnabled-true, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field TypeToSiriEnabled is false (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri TypeToSiriEnabled field is false. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool false + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'TypeToSiriEnabled' AND + value = '0') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-TypeToSiriEnabled-false, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field StatusMenuVisible is true (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri StatusMenuVisible field is true. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool true + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'StatusMenuVisible' AND + value = '1') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-StatusMenuVisible-true, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field StatusMenuVisible is false (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri StatusMenuVisible field is false. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool false + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'StatusMenuVisible' AND + value = '0') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-StatusMenuVisible-false, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field VoiceTriggerUserEnabled is true (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri VoiceTriggerUserEnabled field is true. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool true + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'VoiceTriggerUserEnabled' AND + value = '1') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-VoiceTriggerUserEnabled-true, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field VoiceTriggerUserEnabled is false (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri VoiceTriggerUserEnabled field is false. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool false + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'VoiceTriggerUserEnabled' AND + value = '0') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-VoiceTriggerUserEnabled-false, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field LockscreenEnabled is true (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri LockscreenEnabled field is true. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool true + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'LockscreenEnabled' AND + value = '1') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-LockscreenEnabled-true, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy +spec: + name: CIS - Ensure Siri field LockscreenEnabled is false (Based on organization's policy) + platforms: macOS + platform: darwin + description: | + Extention of CIS-2.5.1. This will check that Siri LockscreenEnabled field is false. + resolution: | + Ask your system administrator to deploy a script that will configure + $ /usr/bin/sudo -u /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool false + query: | + SELECT 1 WHERE NOT EXISTS ( + SELECT 1 FROM users AS u + LEFT JOIN ( + SELECT * FROM plist WHERE + path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND + key = 'LockscreenEnabled' AND + value = '0') AS p + ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist') + WHERE u.directory LIKE '/Users/%' AND + p.value IS NULL + ); + /*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding). + Depending on your organization's decision, you can delete this policy or its counterpart.*/ + purpose: Informational + tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-LockscreenEnabled-false, decision-needed + contributors: sharon-fdm +--- +apiVersion: v1 +kind: policy spec: name: CIS - Ensure Location Services Is Enabled platforms: macOS diff --git a/ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig b/ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig new file mode 100644 index 0000000000..cf61d53acb --- /dev/null +++ b/ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig @@ -0,0 +1,37 @@ + + + + + PayloadContent + + + PayloadDisplayName + test + PayloadType + com.apple.applicationaccess + PayloadIdentifier + com.fleetdm.cis-2.5.1.check-disable + PayloadUUID + 4B56DF79-ECAF-4175-AACC-95F08A980B6C + allowAssistant + + + + PayloadDescription + test + PayloadDisplayName + Disable Siri + PayloadIdentifier + com.fleetdm.cis-2.5.1-disable + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + FB3E1980-5FE2-4C8F-BCF8-6FFF4117C962 + PayloadVersion + 1 + + diff --git a/ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig b/ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig new file mode 100644 index 0000000000..5bac3db11a --- /dev/null +++ b/ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig @@ -0,0 +1,37 @@ + + + + + PayloadContent + + + PayloadDisplayName + test + PayloadType + com.apple.applicationaccess + PayloadIdentifier + com.fleetdm.cis-2.5.1.check-enable + PayloadUUID + DC0652C5-E996-408F-84A0-9F09657FD771 + allowAssistant + + + + PayloadDescription + test + PayloadDisplayName + Enable Siri + PayloadIdentifier + com.fleetdm.cis-2.5.1-enable + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + F5001E34-CC4D-4951-A7A3-A95DC02F0090 + PayloadVersion + 1 + +