diff --git a/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml b/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml index 52796e1ef..a51913533 100644 --- a/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml +++ b/rules/os/os_sleep_and_display_sleep_apple_silicon_enable.yaml @@ -4,15 +4,17 @@ discussion: | Apple Silicon MacBooks should set sleep timeout to 15 minutes (900 seconds) or less and the display sleep timeout should be 10 minutes (600 seconds) or less but less than the sleep setting. check: | error_count=0 - if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -q "MacBook"; then - sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') - displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') - - if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then - ((error_count++)) - fi - if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then - ((error_count++)) + if /usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep -q "MacBook"; then + cpuType=$(/usr/sbin/sysctl -n machdep.cpu.brand_string) + if echo "$cpuType" | grep -q "Apple"; then + sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') + displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') + if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then + ((error_count++)) + fi + if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -gt "$sleepMode" ]]; then + ((error_count++)) + fi fi fi echo "$error_count" diff --git a/rules/system_settings/system_settings_sleep_enforce.yaml b/rules/system_settings/system_settings_sleep_enforce.yaml deleted file mode 100644 index 9a051e0fb..000000000 --- a/rules/system_settings/system_settings_sleep_enforce.yaml +++ /dev/null @@ -1,54 +0,0 @@ -id: system_settings_sleep_enforce -title: Enforce Display Sleep (Apple Silicon) -discussion: | - Display Sleep _MUST_ be enforced on Apple Silicon MacBooks. -check: | - error_count=0 - if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -q "MacBook"; then - sleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep '^\s*sleep' 2>&1 | /usr/bin/awk '{print $2}') - displaysleepMode=$(/usr/bin/pmset -b -g | /usr/bin/grep displaysleep 2>&1 | /usr/bin/awk '{print $2}') - - if [[ "$sleepMode" == "" ]] || [[ "$sleepMode" -gt 15 ]]; then - ((error_count++)) - fi - if [[ "$displaysleepMode" == "" ]] || [[ "$displaysleepMode" -gt 10 ]] || [[ "$displaysleepMode" -lt "$sleepMode" ]]; then - ((error_count++)) - fi - fi - echo "$error_count" -result: - integer: 0 -fix: | - [source,bash] - ---- - /usr/bin/pmset -a sleep 15 - /usr/bin/pmset -a displaysleep 10 - ---- -references: - cce: - - CCE-93023-0 - cci: - - N/A - 800-53r5: - - N/A - 800-53r4: - - N/A - srg: - - N/A - disa_stig: - - N/A - 800-171r3: - - N/A - cis: - benchmark: - - 2.9.1.2 (level 2) - controls v8: - - 4.1 -macOS: - - '14.0' -tags: - - cis_lvl2 - - cisv8 - - arm64 -mobileconfig: false -mobileconfig_info: