Create macOS policies for SCA

[chemamartinez]

Currently, there are not available security policies for macOS. This is necessary to be able to perform SCA scans in that OS.

This issue attempts to develop SCA policies based on the CIS benchmarks for the multiple macOS versions available. It also depends on the possibility to create checks that read commands output, which is already developed here.

This is the list of available CIS benchmarks for macOS:

• macOS 10.13 (High Sierra)

• macOS 10.12 (Sierra)

• macOS 10.11 (El Capitan)

• macOS 10.10 (Yosemite)

• macOS 10.9 (Mavericks)

• macOS 10.8 (Mountain Lion)

This work has been already started at: 3.9-macos-yaml-policies

[juan70]

2019-04-05

• PR Add CIS benchmarks policy files for MacOS #345

2019-04-04

• Quick testing. cis_apple_macOS_10.11.yml does not work, because Added command execution capability for Security Configuration Assessment wazuh#2696 is not merged yet, so the new c: command option is not yet operational in the currently existing MacOS packages. Anyway, if these checks are removed/hidden, the others work.
  The specific system_audit_rcl_mac.yml and the generic system_audit_ssh.yml work.
• Update the template files to use the correct policy files during installation. PR Update template files for MacOS CIS benchmarks policy files wazuh#3020. Testing on Mac agent and on a manager.

2019-04-03

• Added policy file for MacOS 10.11.

• Added one more check for MacOS 10.12 and 10.13.

• Fix some typos.

• Renumber all the id: fields:

  • cis_apple_macOS_10.13.yml: from 10000
  • cis_apple_macOS_10.12.yml: from 10500
  • cis_apple_macOS_10.11.yml: from 11000

• Reorganize the files in directories named after the version of Darwin:

  OS Version	Codename	Darwin version
  OS X 10.11	El Capitan	15
  macOS 10.12	Sierra	16
  macOS 10.13	High Sierra	17

• Add a specific file for web-related vulnerabilities. It is the same as the generic one, except for the list of directories related to the web contents. These directories don't seem to be located at the same places as for Linux.

2019-04-02

• MacOS 10.13 yml file: renumber id: fields, starting from 10000.
• Policy file for MacOS 10.12. Numbered starting from 10500.
• Started creating policy file for MacOS 10.11.

2019-04-01

• Review the rules for the policies, because some things are forbidden, especially pipes. Some checks cannot be implemented due to this limitation.
• The checks are performed for the current user, which is root. Some checks are useless for root. For example: screen saver, iCloud sync.
• Finally, 29 checks out of 74 Scored checks are implemented.
• TODO: just update the id: fields.

2019-03-29

• New policies for MacOS 10.13. From the file CIS_Apple_macOS_10.13_Benchmark_v1.0.0.pdf, around 31 out of 74 Scored checks have been taken into account for the time being.
• TODO: maybe include more Scored checks, and include some Not Scored ones. And remove the empty policies.

[juan70]

According https://en.wikipedia.org/wiki/MacOS:

Version	Codename	Release date	Most recent version
OS X 10.8	Mountain Lion	July 25, 2012	10.8.5 (12F45) (October 3, 2013)
OS X 10.9	Mavericks	October 22, 2013	10.9.5 (13F1112) (September 18, 2014)
OS X 10.10	Yosemite	October 16, 2014	10.10.5 (14F27) (August 13, 2015)
OS X 10.11	El Capitan	September 30, 2015	10.11.6 (15G31) (July 18, 2016)
macOS 10.12	Sierra	September 20, 2016	10.12.6 (16G29) (July 19, 2017)
macOS 10.13	High Sierra	September 25, 2017	10.13.6 (17G65) (July 9, 2018)
macOS 10.14	Mojave	September 24, 2018	10.14.4 (18E226) (March 25, 2019)

So maybe not all the policy files are going to be implemented. Maybe only 10.13, 10.12 and 10.11.

[juan70]

The generic policy files are used for all the UNIX-like operating systems.
For MacOS:

• generic/system_audit_ssh.yml
  • OK. /etc/ssh/sshd_config exists on MacOS.
• generic/system_audit_rcl.yml

  • /etc, /var are symbolic links to /private/etc, /private/var

  • php.ini seems to be located at /etc/php.ini, which is included in the variable $php.ini.

  • But www directory seems to be:

    • /Library/WebServer/Documents by default
    • or /usr/htdocs if web sharing is not enabled (https://superuser.com/questions/358944/why-is-mac-os-x-lion-apache-documentroot-usr-htdocs)
    • or /usr/local/var/htdocs (https://gist.github.com/DragonBe/0faebe58deced34744953e3bf6afbec7)
    • or /usr/local/var/www (https://getgrav.org/blog/macos-mojave-apache-multiple-php-versions)

    The variable $web_dirs contains none of these paths.

[chemamartinez]

Merged: #345. Thanks @juan70 !!