The macOS system must be configured to disable the Network File System (NFS) lock daemon unless it is required.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214826	AOSX-13-000142	SV-214826r609363_rule		Medium

Description
If the system does not require access to NFS file shares or is not acting as an NFS server, support for NFS is non-essential and NFS services must be disabled. NFS is a network file system protocol supported by UNIX-like operating systems. Enabling any service increases the attack surface for an intruder. By disabling unnecessary services, the attack surface is minimized.

STIG	Date
Apple OS X 10.13 Security Technical Implementation Guide	2021-11-19

Details

Check Text ( C-16026r397050_chk )
If the NFS lock daemon is required, this is not applicable. To check if the NFS lock daemon is disabled, use the following command: /usr/bin/sudo /bin/launchctl print-disabled system | /usr/bin/grep com.apple.lockd If the results do not show the following, this is a finding: "com.apple.lockd" => true

Fix Text (F-16024r397051_fix)
To disable the NFS lock daemon, run the following command: /usr/bin/sudo /bin/launchctl disable system/com.apple.lockd The system may need to be restarted for the update to take effect.