id: sip-disabled

info:
  name: macOS System Integrity Protection (SIP) Disabled
  author: geeknik
  severity: high
  description: |
    Validates whether System Integrity Protection (SIP) is disabled, removing critical restrictions on system modifications.
  impact: |
    Disabling SIP significantly weakens the security of the system, making it more vulnerable to malware and unauthorized modifications.
  remediation: |
    Enable System Integrity Protection (SIP) to protect the system from unauthorized modifications.
  tags: macos,audit,local,security

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      csrutil status
    matchers:
      - type: word
        words:
          - "System Integrity Protection status: disabled."
# digest: 4b0a00483046022100a9c95ce47a76fc6365a0b50b12e67d6d2da2a2faecd59065b1b0ded05df9ebc9022100a6877fd0ebd4f9c2a736f424a6a383ce72760683f1fd31826405e1f05e945676:922c64590222798bb761d5b6d8e72950