usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

SIP protected services #121

New Issue
Closed
opened 2026-01-19 18:29:18 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:29:18 +00:00
Owner
Copy Link

Originally created by @nihil-admirari on GitHub.

Originally assigned to: @robertgendler on GitHub.

os_anti_virus_installed and os_time_server_enabled are trying to configure services that are SIP protected, i.e. these services cannot be loaded or unloaded, and their disablement status is always ignored.

Since SIP is enforced by os_sip_enable, it may be better to check that these services were not added to /System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist, rather than trying to launchctl load -w them (which errors anyway)?

Originally created by @nihil-admirari on GitHub. Originally assigned to: @robertgendler on GitHub. [os_anti_virus_installed](https://github.com/usnistgov/macos_security/blob/sonoma/rules/os/os_anti_virus_installed.yaml) and [os_time_server_enabled](https://github.com/usnistgov/macos_security/blob/sonoma/rules/os/os_time_server_enabled.yaml) are trying to configure services that are SIP protected, i.e. these services cannot be loaded or unloaded, and their disablement status is always ignored. Since SIP is enforced by [os_sip_enable](https://github.com/usnistgov/macos_security/blob/sonoma/rules/os/os_sip_enable.yaml), it may be better to check that these services were not added to `/System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist`, rather than trying to `launchctl load -w` them (which errors anyway)?
michael commented 2026-01-19 18:29:19 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

We're going to make some changes to the rules that check SIP protected services. It's important to check the status since someone could disable SIP, disable the service, enable SIP.

@robertgendler commented on GitHub: We're going to make some changes to the rules that check SIP protected services. It's important to check the status since someone could disable SIP, disable the service, enable SIP.
michael commented 2026-01-19 18:29:19 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@nihil-admirari check out dev_sonoma_issue345

@robertgendler commented on GitHub: @nihil-admirari check out `dev_sonoma_issue345`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#121
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?