BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

os_unlock_active_user_session_disable Disable Login to Other User's Active and Locked Sessions

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded macOS

Title

Disable Login to Other User's Active and Locked Sessions

Control

RESULT="FAIL"
SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

if [[ "${SS_RULE}" == "$ODV" ]]; then
RESULT="PASS"
else
PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE" 2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -)
if /usr/bin/grep -Fxq "$ODV" <<<"$PSSO_CHECK"; then
RESULT="PASS"
fi
fi

echo $RESULT

Discussion

The ability to log in to another user's active or locked session _MUST_ be disabled.

macOS has a privilege that can be granted to any user that will allow that user to unlock active user's sessions. Disabling the admins and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.

NOTE: Configuring this setting will change the user experience and disable TouchID from unlocking the screensaver. A configuration profile will be generated to include the setting that restores the expected behavior. You can also apply the settings using `/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1`.

WARNING: This rule may cause issues when platformSSO is configured.

Related controls

ia-2, ia-2.5

Fix

[source,bash]
----
SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

if [[ "$SS_RULE" == *psso* ]]; then
/usr/bin/security -q authorizationdb read psso-screensaver > "/tmp/psso-screensaver-mscp.plist"
/usr/bin/sed -i.bak 's/<string>authenticate-session-owner-or-admin<\/string>/<string>$ODV<\/string>/' /tmp/psso-screensaver-mscp.plist
/usr/bin/security -q authorizationdb write psso-screensaver-mscp < /tmp/psso-screensaver-mscp.plist
/usr/bin/security -q authorizationdb write system.login.screensaver psso-screensaver-mscp 2>&1
else
/usr/bin/security -q authorizationdb write system.login.screensaver "$ODV" 2>&1
fi
----