id: gatekeeper-disabled

info:
  name: macOS Gatekeeper Disabled
  author: geeknik
  severity: high
  description: |
    Checks if Gatekeeper is disabled on macOS, removing verification that downloaded applications are from identified developers.
  impact: |
    Disabling Gatekeeper allows the execution of applications from unverified sources, increasing the risk of malware infection.
  remediation: |
    Enable Gatekeeper to ensure that only applications from identified developers can be run.
  tags: macos,audit,local,security

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      spctl --status
    matchers:
      - type: word
        words:
          - "assessments disabled"
# digest: 4b0a00483046022100c13d86b99f8f878a28f12b93336ffc8b2041992d8469e55e5f4253fe313aaf920221009d4860d4ef526c896fd5ca9018bfec060b55f363a0e8efe3bdbe53c6673bc5ec:922c64590222798bb761d5b6d8e72950