os_setup_assistant_filevault_enforce checks for wrong type #110

New Issue

michael · 2026-01-19T18:29:16Z

michael commented

2026-01-19 18:29:16 +00:00

Originally created by @bernstei on GitHub.

On Sonoma 14.3.1, check for os_setup_assistant_filevault_enforce expects an integer (1), but the command (which I really don't understand) appears to return a bool-like string

> /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\
  .objectForKey('ForceEnableInSetupAssistant').js
EOS
true

Apple's docs here https://developer.apple.com/documentation/devicemanagement/fdefilevault suggest that it is supposed to be bool, not integer.

Originally created by @bernstei on GitHub. On Sonoma 14.3.1, check for `os_setup_assistant_filevault_enforce` expects an integer (1), but the command (which I really don't understand) appears to return a bool-like string ``` > /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ .objectForKey('ForceEnableInSetupAssistant').js EOS true ``` Apple's docs here https://developer.apple.com/documentation/devicemanagement/fdefilevault suggest that it is supposed to be bool, not integer.

michael closed this issue

2026-01-19 18:29:16 +00:00

michael commented

2026-01-19 18:29:16 +00:00

@brodjieski commented on GitHub:

Thanks for bringing this up. Turns out that the check is a bit incorrect. It should be (note the missing .js):

  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\
  .objectForKey('ForceEnableInSetupAssistant')
  EOS

This will result in a 1 or 0, which MSCP interprets as an integer value. The setting itself in the config profile should be a boolean.

Sorry for the confusion, and we will get it fixed. Thanks again!

@brodjieski commented on GitHub: Thanks for bringing this up. Turns out that the check is a bit incorrect. It should be (note the missing .js): ``` /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX.FileVault2')\ .objectForKey('ForceEnableInSetupAssistant') EOS ``` This will result in a 1 or 0, which MSCP interprets as an integer value. The setting itself in the config profile should be a boolean. Sorry for the confusion, and we will get it fixed. Thanks again!

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#110