5.1.7 Ensure No World Writable Files Exist in the Library Folder

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Software sometimes insists on being installed in the /System/Volumes/Data/Library Directory and has inappropriate world-writable permissions.

Rationale:

Folders in /System/Volumes/Data/Library should not be world-writable. The audit check excludes the /System/Volumes/Data/Library/Caches and /System/Volumes/Data/Library/Preferences/Audio/Data folders where the sticky bit is set.

Solution

Terminal Method:
Run the following command to set permissions so that folders are not world-writable in the /System/Volumes/Data/Library folder:

$ /usr/bin/sudo IFS=$'
'
for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data ); do
/bin/chmod -R o-w '$libPermissions'
done

See Also

https://workbench.cisecurity.org/files/4159