5.1.7 Ensure No World Writable Files Exist in the Library Folder

Information

Software sometimes insists on being installed in the /System/Volumes/Data/Library Directory and has inappropriate world-writable permissions.

Rationale:

Folders in /System/Volumes/Data/Library should not be world-writable. The audit check excludes the /System/Volumes/Data/Library/Caches and /System/Volumes/Data/Library/Preferences/Audio/Data folders where the sticky bit is set.

Solution

Terminal Method:
Run the following command to set permissions so that folders are not world-writable in the /System/Volumes/Data/Library folder:

$ /usr/bin/sudo IFS=$'
'
for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do
/bin/chmod -R o-w '$libPermissions'
done

See Also

https://workbench.cisecurity.org/benchmarks/14563

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 8d54f40f8328dd0cbb5f38d4dba8ab21d9fdb457c1efd5f6f39b06b8f9fd9c4a