5.1.7 Ensure No World Writable Files Exist in the Library Folder

Information

Software sometimes insists on being installed in the /System/Volumes/Data/Library Directory and has inappropriate world-writable permissions.

Folders in /System/Volumes/Data/Library should not be world-writable. The audit check excludes the /System/Volumes/Data/Library/Caches and /System/Volumes/Data/Library/Preferences/Audio/Data folders where the sticky bit is set.

Solution

Run the following command to set permissions so that folders are not world-writable in the /System/Volumes/Data/Library folder:

% /usr/bin/sudo IFS=$'
'
for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do
/bin/chmod -R o-w "$libPermissions"
done

See Also

https://workbench.cisecurity.org/benchmarks/17467