@brodjieski commented on GitHub:
The command in the remediation script should change the flags to allow for modifications. Only the /etc/security/audit_control file is affected. Did you run…
@cipineda commented on GitHub:
No I'm not, I installed mSCP project yesterday (09/06/23). I do see that line but I think there are more lines that are missing the unlocking of the files.
@cipineda commented on GitHub:
Here it is.
P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8
dir:/var/audit flags:lo,aa,ad,-ex,-fd,-fm,-fr,-fw minfree:25 naflags:lo,aa p…
@cipineda commented on GitHub:
Complete troubleshoot process:
cat /etc/security/audit_control (displaying relevant lines only)
expire-after:10M
`/usr/bin/sed -i.bak 's/^expire-after.*/e…
@cipineda commented on GitHub:
The rule Im using and reporting in this issue is audit_flags_fm_configure and it failed as coded, until I modified the proposed code above, then it marked the…
@brodjieski commented on GitHub:
Can you share your configuration in /etc/security/audit_control?
@golbiga commented on GitHub:
Generate Guidance which creates the compliance script was updated awhile ago and is in all of the branches.
https://github.com/usnistgov/macos_security/blob/40e4f1…
@brodjieski commented on GitHub:
That configuration does not contain the fm flag, and will fail the check for audit_flags_fm_configure.
I see you have -fm which will pass the check for…
@cipineda commented on GitHub:
The same behavior happens with audit_settings_failure_notify
@brodjieski commented on GitHub:
There are 2 different rules that touch upon the fm flag for auditing. One is audit_flags_fm_configure and the other is audit_flags_fm_failed_configure. …
@robertgendler commented on GitHub:
The launchctl load works just fine.
When SIP is enabled, you can't disable Xprotect and so you can't load XProtect.
If you disable SIP, then stop and…
@robertgendler commented on GitHub:
If you have an additional questions. Feel free to re-open it.
@cipineda commented on GitHub:
Are you saying that the flags: should not have a dash at all?
@cipineda commented on GitHub:
ok, that is odd, because running the code as originally provided threw the errors right away of not being able to modify the files.
@cipineda commented on GitHub:
not particularly with the --fix but rather using the interactive 4 options menu. But yes not running manually.
@cipineda commented on GitHub:
running the fix is where it fails with error sed: rename(): Operation not permitted.
I added the following functions and called them before and after each…