The Apple Hardening Policy applies security hardening on managed Macs, through the Swif agent. It has three settings, each based on a CIS macOS Benchmark recommendation:

All three are off by default.

Important: Removing the policy undoes only some changes. The Swif agent changes the Mac directly, not through a configuration profile. If you remove the policy, app permissions and the install log settings stay as the policy left them.

Secure Home Folders is different: its changes are put back about 10–12 minutes after the policy is removed.

To check the agent version on a Mac, run:

Some apps install with permissions that let any user on the Mac change them. A standard user, or malware running as that user, could then tamper with the app. When this setting is on:

Apps that update themselves. An app a user copied into /Applications can still be updated by that user. But an app that relied on any user being able to write to it, to update itself, may now ask for an administrator.

Removing the policy doesn't restore the old permissions.

The install log, /var/log/install.log, records software installs and updates. When this setting is on, the Swif agent:

CIS recommends keeping the install log for at least 365 days.

If a macOS update changes these settings back, the agent sets them again within about a minute. A major macOS upgrade can start a new install log, so entries from before the upgrade may not be kept.

Removing the policy doesn't restore Apple's settings.

By default, other users on a Mac can see what's in each user's home folder. When this setting is on:

This also helps meet the FDC-1 control in the Compliance Center.

Both meet CIS 5.1.1. macOS's built-in protection that stops home folders from being deleted is kept with either value.

Use this for accounts whose home folders others need, such as a service account whose files another account uses. An entry matches an account's short name, or a folder name in /Users, and ignores case.

Before turning this on, check for anything that reads another user's home folder, such as:

Turning off Secure Home Folders, removing the policy, or adding an account to Excluded Accounts puts back the permissions the agent changed. Each folder goes back to the permissions it had right before the agent's last change, unless someone changed them since. After the policy is removed, this takes about 10–12 minutes.

The CIS hardening settings that aren't in this policy are in these policies instead:

Meets CIS 3.3, 5.1.1, and 5.1.5. Users can still share files through Public and Drop Box.

Keeps two years of install history for audits.

Other users can't open anything in a home folder, except the buildagent service account's, which another account uses.

Run these in Terminal on the Mac.

World-writable app permissions. This should return 0:

This is the same check mSCP uses for CIS 5.1.5.

Install log retention. The line should end with ttl= and your number of days, with no all_max:

To confirm macOS is using it, this should show TTL = and your number of days:

Home folders. Home folders should show drwx--x--x for 711, or drwx------ for 700:

Shared, Guest, and excluded accounts keep their own permissions.

Run the checks right away. The agent applies changes within about a minute. To make it check now:

In Swif, open the device and confirm that the policy shows as applied.

This is expected after world-writable permissions are removed. The app could previously update itself because any user could write to it. Update the app through Swif, or have an administrator approve the update.

A major macOS upgrade can start a new install log. Entries from before the upgrade may not be kept.

Secure Home Folders is on. With 700, other users can't open anything in a home folder, including Public and Drop Box. Switch to 711, add the account to Excluded Accounts, or share files through /Users/Shared.

Add the account whose home folder it needs to Excluded Accounts. The agent puts back that folder's permissions, unless someone changed them since.

This is expected. Secure Home Folders covers only home folders in /Users.

This is expected for app permissions and install log settings. Removing the policy doesn't restore them. Home folder permissions are put back about 10–12 minutes after the policy is removed, unless someone changed them since.