Title

All library files must not have extended ACLs. (Cat II impact)

Discussion

Unauthorized access could destroy the integrity of the library files.

Check Content

Open a terminal session and enter the following command to view the library file ACLs. ls -lLR /System/Library/Frameworks /Library/Frameworks /usr/lib /usr/local/lib If the permissions include a '+', the file has an extended ACL, this is a finding.

Fix Text

Open a terminal session and enter the following command to remove the extended ACLs. chmod -RN /System/Library/Frameworks /Library/Frameworks /usr/lib /usr/local/lib

Additional Identifiers

Rule ID: SV-38075r1_rule

Vulnerability ID: V-22317

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.