Overview
The Apple Hardening Policy applies security hardening on managed Macs through the Swif agent. It can:
Remove world-writable permissions from apps, so standard users and malware can't change apps installed in
/ApplicationsKeep the install log for a set number of days, so you have a record of software installs and updates when investigating an incident
Both settings follow CIS macOS Benchmark recommendations, and both are off by default.
Important: Removing the policy doesn't undo its changes. The Swif agent changes files and settings on the Mac directly. If you remove or unassign the policy, app permissions and the install log settings stay as the policy left them.
Supported platforms and requirements
Item | Details |
Platform | macOS 12 or later |
Device ownership | Company-owned and BYOD |
Swif agent | Required. Both settings are applied by the agent, not by a configuration profile. |
Settings reference
Setting | What it does | Default | CIS macOS Benchmark |
Remove World-Writable Permissions from Applications | Finds apps in | Off | 5.1.5 |
Set Install Log Retention | Sets how long macOS keeps the install log, and removes Apple's size limit on it. | Off | 3.3 |
Keep install.log for (days) | How many days to keep install log entries. Shown only when Set Install Log Retention is on. | 365 | 3.3 |
Remove World-Writable Permissions from Applications
Some apps install with permissions that let any user on the Mac change them. That means a standard user, or malware running as that user, could tamper with the app. When this setting is on:
The Swif agent finds apps in
/Applicationsthat any user can write to, and removes that write access.The agent checks again every hour, so apps installed or updated later are covered too.
Apps that update themselves may need an administrator. Some apps install their own updates without asking for an administrator password, because their folder is world-writable. After this setting removes that access, those apps may ask for an administrator to install updates. Plan to update them through Swif, or make sure users can get administrator approval.
Set Install Log Retention
The install log (/var/log/install.log) records software installs and updates on the Mac. It helps when investigating incidents, such as finding when an unexpected app was installed. When this setting is on, the Swif agent:
keeps install log entries for the number of days in Keep install.log for (days)
removes Apple's total size limit on the log. With that limit, macOS deletes the oldest entries first once the log reaches a certain size.
Choose the retention period. CIS recommends at least 365 days. The allowed range is [minimum]–[maximum] days.
Major macOS upgrades can start a new log. After a major upgrade, such as macOS 15 to macOS 26, macOS may start a new install log, so entries from before the upgrade may not be kept.
Before you start
Install the Swif agent on the Macs.
Check apps that update themselves. Find out which apps your users rely on that install their own updates, and plan how they'll be updated once their write access is removed.
Check your log retention requirements. Use at least 365 days to meet CIS, or longer if your compliance framework requires it.
Choose a pilot group of Macs.
Create the policy
In Swif, go to Device Management > Policies > New Policy.
Select Apple Hardening Policy.
Enter a clear name, such as
Mac Hardening – CIS.Turn on Remove World-Writable Permissions from Applications.
Turn on Set Install Log Retention, then set Keep install.log for (days).
Save the policy.
Assign it to a device group of Macs.
Example configurations
Example 1: CIS baseline for all company Macs
Setting | Value |
Remove World-Writable Permissions from Applications | On |
Set Install Log Retention | On |
Keep install.log for (days) | 365 |
Meets CIS macOS Benchmark recommendations 3.3 and 5.1.5.
Example 2: Longer log retention for regulated teams
Setting | Value |
Remove World-Writable Permissions from Applications | On |
Set Install Log Retention | On |
Keep install.log for (days) | 730 |
Keeps two years of install history for audits.
Example 3: Log retention only
Setting | Value |
Remove World-Writable Permissions from Applications | Off |
Set Install Log Retention | On |
Keep install.log for (days) | 365 |
Use this while you check which apps update themselves, before you remove world-writable permissions.
Verify the policy
World-writable app permissions
Run this in Terminal on the Mac. It lists apps in /Applications that any user can write to. After the policy applies, it should return nothing:
find /Applications -maxdepth 1 -perm -2 -name "*.app"
Install log retention
Run this in Terminal to check the install log's retention settings:
grep -i "ttl\|all_max" /etc/asl/com.apple.install
The output should show the number of days you set as ttl, with no all_max size limit.
In Swif, open the device and confirm that the policy shows as applied.
Troubleshooting
An app asks for an administrator to install updates
This is expected after world-writable permissions are removed. The app could previously update itself because any user could write to it. Update the app through Swif, or have an administrator approve the update.
The find command still lists an app
Check that the Swif agent is running.
Wait up to an hour for the agent's next check.
Check that the app is in
/Applications. Apps in other folders aren't covered.
Install log entries from before an upgrade are missing
A major macOS upgrade can start a new install log. Entries from before the upgrade may not be kept, even with retention set.
Permissions or log settings didn't change back after I removed the policy
This is expected. Removing the policy doesn't restore the previous permissions or Apple's log settings.