Run Nessus on macOS as a Non-Privileged User

Limitations

When scanning localhost, Nessus plugins assume that they are running as root. Therefore, certain types of scans may fail. For example, because Nessus is now running as a non-privileged user, file content Compliance Audits may fail or return erroneous results since the plugins are not able to access all directories.
nessuscli does not have a --no-root mode. Running commands with nessuscli as root could potentially create files in the Nessus install directory owned by root, which could cause Nessus to be unable to access them appropriately. Use care when running nessuscli, and potentially fix permissions with chown after using it.

Steps

If you have not already done so, Install Nessus on MacOSX.
Since the Nessus service is running as root, you need to unload it.

Use the following command to unload the Nessus service:

sudo launchctl unload /Library/LaunchDaemons/com.tenablesecurity.nessusd.plist
On the Mac, in System Preferences > Users & Groups, create a new Group.
Next, in System Preferences > Users & Groups, create the new Standard User. Configure this user to run as the Nessus non-privileged account.
Add the new user to the group you created in Step 1.
Remove 'world' permissions on Nessus binaries in the /sbin directory.

sudo chmod 750 /Library/Nessus/run/sbin/*
Change ownership of /Library/Nessus/run directory to the non-root (Standard) user you created in Step 2.

sudo chown -R nonprivuser:nonprivuser /Library/Nessus/run
Give that user read/write permissions to the /dev/bpf* devices. A simple way to do this is to install Wireshark, which creates a group called access_bpf and a corresponding launch daemon to set appropriate permissions on /dev/bpf* at startup. In this case, you can simply assign the nonpriv user to be in the access_bpf group. Otherwise, you need to create a launch daemon giving the "nonpriv" user, or a group that it is a part of, read/write permissions to all /dev/bpf*.
For Step 8. changes to take effect, reboot your system.
Using a text editor, modify the Nessus /Library/LaunchDaemons/com.tenablesecurity.nessusd.plist file and add the following lines. Do not modify any of the existing lines.

<string>--no-root</string>

<key>UserName</key>

<string>nonprivuser</string>
Using sysctl, verify the following parameters have the minimum values:

$ sysctl debug.bpf_maxdevices

debug.bpf_maxdevices: 16384

$ sysctl kern.maxfiles

kern.maxfiles: 12288

$ sysctl kern.maxfilesperproc

kern.maxfilesperproc: 12288

$ sysctl kern.maxproc

kern.maxproc: 1064

$ sysctl kern.maxprocperuid

kern.maxprocperuid: 1064
If any of the values in Step 9. do not meet the minimum requirements, take the following steps to modify values.

Create a file called /etc/sysctl.conf.
Using a text editor, edit the systctl.conf file with the correct values found in Step 9.

Example:

$ cat /etc/sysctl.conf

kern.maxfilesperproc=12288

kern.maxproc=1064

kern.maxprocperuid=1064
Next, using the launchctl limit command, verify your OS default values.

Example: MacOSX 10.10 and 10.11 values.

$ launchctl limit

cpu unlimited unlimited

filesize unlimited unlimited

data unlimited unlimited

stack 8388608 67104768

core 0 unlimited

rss unlimited unlimited

memlock unlimited unlimited

maxproc 709 1064

maxfiles 256 unlimited
If you do not set any of the values in Step 11 to the default OSX values above, take the following steps to modify values.

Using a text editor, edit the launchd.conf file with the correct, default values as shown in Step 11.

Example:

$ cat /etc/launchd.conf

limit maxproc 709 1064

Note: Some older versions of OSX have smaller limits for maxproc. If your version of OSX supports increasing the limits through /etc/launchctl.conf, increase the value.
For all changes to take effect either reboot your system or reload the launch daemon.

sudo launchctl load /Library/LaunchDaemons/com.tenablesecurity.nessusd.plist