BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

os_home_folders_default Configure User's Home Folders to Apple's Default

NIST macOS Security Compliance Project Tahoe Guidance, Revision 3.0 (cf656e8)
All changes in this version
first version loaded macOS

Title

Configure User's Home Folders to Apple's Default

Control

Verify the macOS system is configured so that permissions are set correctly on user home directories with the following commands:
/bin/ls -le /Users

This command will return a listing of the permissions of the root of every user account configured on the system. For each of the users, the permissions must be "drwxr-xr-x+", with the user listed as the owner and the group listed as \"staff\". The plus(+) sign indicates an associated Access Control List, which must be:
0: group:everyone deny delete

For every authorized user account, also run the following command:
/usr/bin/sudo /bin/ls -le /Users/userid, where userid is an existing user.

This command will return the permissions of all the objects under the users' home directory. The permissions for each of the subdirectories must be:
drwx------+
0: group:everyone deny delete

The exception is the \"Public\" directory, whose permissions must match the following:

drwxr-xr-x+
0: group:everyone deny delete

If the permissions returned by either of these checks differ from what is shown, this is a finding.

Discussion

The system _MUST_ be configured to prevent access to other user's home folders.

Configuring the operating system to use the most restrictive permissions possible for user home directories helps to protect against inadvertent disclosures.

Related controls

ac-6

Fix

Configure the macOS system to set the appropriate permissions for each user on the system with the following command:

`/usr/sbin/diskutil resetUserPermissions / DeviceNode UID`, where "DeviceNode UID" is the ID number for the user whose home directory permissions need to be repaired.

NOTE: Using the `/usr/sbin/diskutil resetUserPermissions` command will only reset the permissions on the default folder set. Other folders in the home directory will not be affected.