mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 08:55:24 +00:00
MAC CIS 13_2.1.1.2 (#10161)
This commit is contained in:
Sharon Katz
GitHub
parent
a19d73511e
commit
8c9d33f455
@ -103,6 +103,66 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Drive storage solution is disabled (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
iCloud Drive is Apple's storage solution for applications on both macOS and iOS to use the same files that are resident in Apple's cloud storage. The iCloud Drive folder is available much like Dropbox, Microsoft OneDrive, or Google Drive.
|
||||
One of the concerns in public cloud storage is that proprietary data may be inappropriately stored in an end user's personal repository. Organizations that need specific controls on information should ensure that this service is turned off or the user knows what information must be stored on services that are approved for storage of controlled information.
|
||||
This query will check for the existance of the policy not its value (That should be set per organization's decision)
|
||||
resolution: |
|
||||
The administrator should configure this via MDM profile.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.applicationaccess.
|
||||
2. The key to include is allowCloudDocumentSync.
|
||||
3. The key must be set to <false/>.
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowCloudDocumentSync'
|
||||
AND (value = '1' OR value = 'true')
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.1.1.2-disabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Drive storage solution is enabled (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
iCloud Drive is Apple's storage solution for applications on both macOS and iOS to use the same files that are resident in Apple's cloud storage. The iCloud Drive folder is available much like Dropbox, Microsoft OneDrive, or Google Drive.
|
||||
One of the concerns in public cloud storage is that proprietary data may be inappropriately stored in an end user's personal repository. Organizations that need specific controls on information should ensure that this service is turned off or the user knows what information must be stored on services that are approved for storage of controlled information.
|
||||
This query will check for the existance of the policy not its value (That should be set per organization's decision)
|
||||
resolution: |
|
||||
The administrator should configure this via MDM profile.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.applicationaccess.
|
||||
2. The key to include is allowCloudDocumentSync.
|
||||
3. The key must be set to <true/>.
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowCloudDocumentSync'
|
||||
AND (value = '0' OR value = 'false')
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.1.1.2-enabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Keychain is disabled (if your org policy is to disable it) (MDM Required)
|
||||
platforms: macOS
|
||||
|
||||
37
ee/cis/macos-13/test/profiles/2.1.1.2-disable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.1.1.2-disable.mobileconfig
Normal file
@ -0,0 +1,37 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.applicationaccess</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.2.check-disable</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>1028E002-9AFE-446A-84E0-27DA5DA39B4A</string>
|
||||
<key>allowCloudDocumentSync</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Disable iCloud Drive storage solution usage</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.2-disable</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>7B3DE4EA-0AFA-44F5-9716-37526EE441EA</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
37
ee/cis/macos-13/test/profiles/2.1.1.2-enable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.1.1.2-enable.mobileconfig
Normal file
@ -0,0 +1,37 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.applicationaccess</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.2.check-enable</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>8618AA0E-B6AC-4D1C-AE01-C46956EC1926</string>
|
||||
<key>allowCloudDocumentSync</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Enable iCloud Drive storage solution usage</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.2-enable</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>2C2FC587-14E8-4A52-98B5-30BA1C975BBA</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
Loading…
Reference in New Issue
Block a user