crsleeth

Title,Finding,Result value,Expected Result,Name,Discussion
iCloud
Disable iCloud Desktop and Document Folder Sync,true,null,string: false,icloud_sync_disable,The macOS system's ability to automatically synchronize a user's desktop and documents folder to their iCloud Drive _MUST_ be disabled.Apple's iCloud service does not provide an organization with enough control over the storage and access of data and therefore automated file synchronization _MUST_ be controlled by an organization approved service.
Auditing
Configure Audit Log Folders Group to Wheel,false,0,integer: 0,audit_folder_group_configure,Audit log files _MUST_ have the group set to wheel.The audit service _MUST_ be configured to create log files with the correct group ownership to prevent normal users from reading audit logs.Audit logs contain sensitive data about the system and users. If log files are set to be readable and writable only by system administrators the risk is mitigated.
Configure System to Audit All Failed Change of Object Attribu

crsleeth

Title,Finding,Result value,Expected Result,Name,Discussion
Auditing
Configure Audit Log Folders Group to Wheel,false,0,integer: 0,audit_folder_group_configure,Audit log files _MUST_ have the group set to wheel.The audit service _MUST_ be configured to create log files with the correct group ownership to prevent normal users from reading audit logs.Audit logs contain sensitive data about the system and users. If log files are set to be readable and writable only by system administrators the risk is mitigated.
Configure Audit_Control Owner to Mode 440 or Less Permissive,false,0,integer: 0,audit_control_mode_configure,/etc/security/audit_control _MUST_ be configured so that it is readable only by the root user and group wheel.
Configure Audit Log Folder to Not Contain Access Control Lists,false,0,integer: 0,audit_acls_folders_configure,The audit log folder _MUST_ not contain access control lists (ACLs).Audit logs contain sensitive data about the system and users. This rule ensures that the audit service is confi

crsleeth

#!/bin/sh

HELPER_SRC="/Applications/Jamf Compliance Editor.app/Contents/Resources/com.jamf.complianceeditor.helper"
HELPER_DST="/Library/PrivilegedHelperTools/com.jamf.complianceeditor.helper"
PLIST_DST="/Library/LaunchDaemons/com.jamf.complianceeditor.helper.plist"

# Create PrivilegedHelperTools directory if missing
if [ ! -d /Library/PrivilegedHelperTools ]; then
    mkdir -p /Library/PrivilegedHelperTools
    chmod 755 /Library/PrivilegedHelperTools