macos:gatekeeper

Description

The macos:gatekeeper test is used to check the status of Gatekeeper and any unsigned applications that have been granted execute permission.

The gatekeeper_object element is a singleton, used by a gatekeeper_test to access information about Gatekeeper.

The gatekeeper_state element makes it possible to make assertions about Gatekeeper’s operational status and unsigned applications that have been granted execute permission.

Technical Details

Artifact Parameters

macos.gatekeeper_v1

Name	Type	Description
gatekeeper	string	macos.gatekeeper_v1 is a singleton, effectively unused and not required.

Supported Test Types

• macos:gatekeeper_enabled

Test Type Parameters

macos.gatekeeper_enabled_v1

Name	Type	Description
check_existence	string	Defines how many items should be collected.
check	string	Defines how many collected items must match the expected state.
operation	string	Comparison operation.
datatype	string	Data type.
enabled	bolean	The status of Gatekeeper assessments.

NOTE: The check_existence parameter is governed by a constraint allowing only the following values:

• all_exist

• any_exist

• at_least_one_exists

• none_exist

• only_one_exists

NOTE: The check parameter is governed by a constraint allowing only the following values:

• all

• at least one

• none satisfy

• only one

NOTE: The operation parameter is governed by a constraint allowing only the following values:

• equals

• not equal

• case insensitive equals

• case insensitive not equal

• greater than

• less than

• greater than or equal

• less than or equal

• bitwise and

• bitwise or

• pattern match

• subset of

• superset of

NOTE: The datatype parameter is governed by a constraint allowing only the following values:

• boolean

• float

• int

• string

• version

• set

Generated Content

macos.gatekeeper_enabled_v1

XCCDF+AE

This is what the AE check looks like, inside a Rule, in the XCCDF.

<xccdf:check system="https://benchmarks.cisecurity.org/ae/0.5">
  <xccdf:check-content>
    <ae:artifact_expression id="xccdf_org.cisecurity.benchmarks_ae_[SECTION-NUMBER]">
      <ae:artifact_oval_id>[ARTIFACT-OVAL-ID]</ae:artifact_oval_id>
      <ae:title>[ARTIFACT-TITLE]</ae:title>
      <ae:artifact type="[ARTIFACT-TYPE-NAME]">
        <ae:parameters>
          <ae:parameter dt="string" name="gatekeeper">[gatekeeper.value]</ae:parameter>
        </ae:parameters>
      </ae:artifact>
      <ae:test type="[TEST-TYPE-NAME]">
        <ae:parameters>
          <ae:parameter dt="string" name="check_existence">[check_existence.value]</ae:parameter>
          <ae:parameter dt="string" name="check">[check.value]</ae:parameter>
          <ae:parameter dt="string" name="operation">[operation.value]</ae:parameter>
          <ae:parameter dt="string" name="datatype">[datatype.value]</ae:parameter>
          <ae:parameter dt="boolean" name="enabled">[enabled.value]</ae:parameter>
        </ae:parameters>
      </ae:test>
      <ae:profiles>
        <ae:profile idref="xccdf_org.cisecurity.benchmarks_profile_Level_1" />
      </ae:profiles>
    </ae:artifact_expression>
  </xccdf:check-content>
</xccdf:check>

SCAP

XCCDF

For macos.gatekeeper_v1 macos.gatekeeper_enabled_v1 artifacts, the XCCDF check looks like this. There is no Value element in the XCCDF for this artifact.

<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
  <check-content-ref
    href="[BENCHMARK-TITLE]-oval.xml"
    name="oval:org.cisecurity.benchmarks.[PLATFORM]:def:[ARTIFACT-OVAL-ID]" />
</check>

OVAL

Test

<macos:gatekeeper_test
  xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos"
  id="oval:org.cisecurity.benchmarks.[PLATFORM]:tst:[ARTIFACT-OVAL-ID]"
  check_existence="[check_existence.value]"
  check="[check.value]"
  comment="[ARTIFACT-TTILE]"
  version="1">
  <macos:object object_ref="oval:org.cisecurity.benchmarks.[PLATFORM]:obj:[ARTIFACT-OVAL-ID]" />
  <macos:state state_ref="oval:org.cisecurity.benchmarks.[PLATFORM]:ste:[ARTIFACT-OVAL-ID]" />
</macos:gatekeeper_test>

Object

<macos:gatekeeper_object
  xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos"
  id="oval:org.cisecurity.benchmarks.[PLATFORM]:obj:[ARTIFACT-OVAL-ID]"
  comment="[ARTIFACT-TTILE]"
  version="1" />

State

<macos:gatekeeper_state
  xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos"
  id="oval:org.cisecurity.benchmarks.[PLATFORM]:ste:[ARTIFACT-OVAL-ID]"
  comment="[ARTIFACT-TTILE]"
  version="1">
  <macos:enabled
    datatype="[datatype.value]"
    operation="[operation.value]">
      [enabled.value]
  </macos:enabled>
</macos:gatekeeper_state>

YAML

artifact-expression:
  artifact-unique-id: "[ARTIFACT-OVAL-ID]"
  artifact-title: "[ARTIFACT-TITLE]"
  artifact:
    type: "[ARTIFACT-TYPE-NAME]"
    parameters:
      - parameter:
          name: "gatekeeper"
          dt: "string"
          value: "[gatekeeper.value]"
  test:
    type: "[TEST-TYPE-NAME]"
    parameters:
      - parameter:
          name: "check_existence"
          dt: "string"
          value: "[check_existence.value]"
      - parameter:
          name: "check"
          dt: "string"
          value: "[check.value]"
      - parameter:
          name: "operation"
          dt: "string"
          value: "[operation.value]"
      - parameter:
          name: "datatype"
          dt: "string"
          value: "[datatype.value]"
      - parameter:
          name: "enabled"
          dt: "string"
          value: "[enabled.value]"

JSON

{
  "artifact-expression": {
    "artifact-unique-id": "[ARTIFACT-OVAL-ID]",
    "artifact-title": "[ARTIFACT-TITLE]",
    "artifact": {
      "type": "[ARTIFACT-TYPE-NAME]",
      "parameters": [
        {
          "parameter": {
            "name": "gatekeeper",
            "type": "string",
            "value": "[gatekeeper.value]"
          }
        }
      ]
    },
    "test": {
      "type": "[TEST-TYPE-NAME]",
      "parameters": [
        {
          "parameter": {
            "name": "check_existence",
            "type": "string",
            "value": "[check_existence.value]"
          }
        },
        {
          "parameter": {
            "name": "check",
            "type": "string",
            "value": "[check.value]"
          }
        },
        {
          "parameter": {
            "name": "operation",
            "type": "string",
            "value": "[operation.value]"
          }
        },
        {
          "parameter": {
            "name": "datetype",
            "type": "string",
            "value": "[datatype.value]"
          }
        },
        {
          "parameter": {
            "name": "enabled",
            "type": "string",
            "value": "[enabled.value]"
          }
        }
      ]
    }
  }
}