CIS Update - macOS 14, CIS v1.1.0

[defensivedepth]

Changelog

ADD:

ADD - 2.3.3.2 Ensure the Time Service Is Enabled
ADD - 6.3.10 Ensure Show Status Bar Is Enabled

REMOVE:

REMOVE - 2.3.2.2 Ensure Time Is Set Within Appropriate Limits

UPDATE:

UPDATE - 2.6.1.2  Ensure Location Services Is in the Menu Bar
UPDATE - 3.1 Ensure Security Auditing Is Enabled 
UPDATE - 5.1.6 Ensure No World Writable Folders Exist in the System Folder
UPDATE - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
UPDATE - 2.9.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel)
UPDATE - 2.9.1.2 Ensure the OS Is Not Active When Resuming from Sleep and Display Sleep (Apple Silicon)

[sharon-fdm]

@lucasmrod, when checking the list of users in managed_policies I find username = NULL for which the field ShowOverlayStatusBar = 1 is not deployed by the profile.

Thus this will not work.

SELECT 1 WHERE NOT EXISTS (
      SELECT 1 FROM users AS u
      LEFT JOIN (
        SELECT username FROM managed_policies WHERE
            domain=‘com.apple.Safari’ AND
            name=‘ShowOverlayStatusBar’ AND
            (value != 1 OR value != ‘true’)
      ) AS p
      ON p.username = u.username OR p.username IS NULL
    );

The problem remains that the profile only deploys the desired outcome to one username.
The query as it is now (I removed AND username='') does work here.
TMWYT

[lucasmrod]

I ran the following steps:

1. Installed https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig on a macOS 14 VM with one user account "lucas".
2. managed_policies returns the applied setting as expected and with username="lucas"
3. I then created another user "gandalf".
4. managed_policies still returns the same results as (2).
5. I log out as "lucas" and log in as "gandalf".
6. managed_policies now returns two rows with domain='com.apple.Safari', name='ShowOverlayStatusBar' (one with username='lucas' and one with username='gandalf').
   

This means the domain='com.apple.Safari', name='ShowOverlayStatusBar' setting is system wide and, once applied, macOS makes sure all users have such setting applied (IOW, we don't care about username). Thus, knowing this, the query that we need is now actually simpler:

SELECT 1 FROM managed_policies WHERE domain='com.apple.Safari' AND name='ShowOverlayStatusBar' AND (value = 1 OR value = 'true');

[sharon-fdm]

@lucasmrod, In that case the existing query is G2G.
I will merge soon.