The OS X system must be configured so that end users cannot override Gatekeeper settings.

From Apple OS X 10.12 Security Technical Implementation Guide

Associated with: CCI-000366

SV-90775r1_rule The OS X system must be configured so that end users cannot override Gatekeeper settings.

Vulnerability discussion

Gatekeeper must be configured with a configuration profile to prevent normal users from overriding its setting. If users are allowed to disable Gatekeeper or set it to a less restrictive setting, malware could be introduced into the system. Gatekeeper is a security feature that ensures applications must be digitally signed by an Apple-issued certificate in order to run. Digital signatures allow Mac OS X to verify the application has not been modified by a malicious third party.

Check content

To verify the user cannot override Gatekeeper settings, type the following code: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep DisableOverride If "DisableOverride" is not set to "1", this is a finding.

Fix text

This setting is enforced using the "Security and Privacy Policy" configuration profile.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.