Mac-OS Baseline

[je4yfc]

Hello,

I created an attempt at an InSpec baseline for MacOS.

https://github.com/je4yfc/dev-sec-mac-baseline

Feel free to steal as much or as little as you like. I did my best to follow your conventions and create a working profile. I attribute the copyright to you as I followed your practices, and give you my full sign-off to take the code.

[rndmh3ro]

Thank you! Though I don't know if we have the capacity or tools to maintain this. Maybe anyone else could chime in here? Would you be willing to help here?

[je4yfc]

I'm more than happy to keep doing my best.

If your team takes ownership of the repo and the headache of finding a replacement for me if I get hit by a bus, I'm happy to keep submitting pull requests and contributing. I use ansible-collection-hardening religiously for Debian Trixie servers and I'm working on an addition to support MacOS (which is why I created this in-spec as a baseline, to follow your existing conventions). I'd basically be primary working on the Ansible side, and then backporting to the in-spec profile.

I've only got a single Mac Mini on the latest MacOS for testing, so I can't commit to supporting older intel macs outside "doing my best to read the CIS documentation and writing code that looks right". Community help is welcome there, but unless someone has an older mac, I'd basically say they are not supported due to lack of hardware for testing at this time.