The macOS system must enable Authenticated Root.
An XCCDF Rule
Description
Authenticated Root must be enabled. When Authenticated Root is enabled, the macOS is booted from a signed volume that is cryptographically protected to prevent tampering with the system volume. NOTE: Authenticated Root is enabled by default on macOS systems. WARNING: If more than one partition with macOS is detected, the csrutil command will hang awaiting input.
- ID
- SV-268565r1034635_rule
- Version
- APPL-15-005070
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the macOS system to enable authenticated root with the following command:
/usr/bin/csrutil authenticated-root enable
NOTE: To reenable "Authenticated Root", boot the affected system into "Recovery" mode, launch "Terminal" from the "Utilities" menu, and run the command.