usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

system_settings_remote_management_disable avoid undocumented mdmclient #122

New Issue
Closed
opened 2026-01-19 18:29:18 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:29:18 +00:00
Owner
Copy Link

Originally created by @nihil-admirari on GitHub.

system_settings_remote_management_disable check uses mdmclient, whose man page states:

WARNING: All command arguments are private. The arguments and output can and will change without notice. Do not rely on any output this command may produce.

CIS “2.3.3.6 Ensure Remote Management Is Disabled” simply does a pgrep:

! /usr/bin/pgrep -q ARDAgent && :
echo $?

May be it makes sense to switch away from mdmclient, considering that CIS have already done so?

Originally created by @nihil-admirari on GitHub. [system_settings_remote_management_disable](https://github.com/usnistgov/macos_security/blob/main/rules/system_settings/system_settings_remote_management_disable.yaml) check uses `mdmclient`, whose man page states: > WARNING: All command arguments are private. The arguments and output can and will change without notice. Do not rely on any output this command may produce. CIS “2.3.3.6 Ensure Remote Management Is Disabled” simply does a `pgrep`: ```sh ! /usr/bin/pgrep -q ARDAgent && : echo $? ``` May be it makes sense to switch away from `mdmclient`, considering that CIS have already done so?
michael commented 2026-01-19 18:29:19 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Reviewing this again. If mdmclient does change and ends up being not the best method to check when an OS update or upgrade is released, we will update our checks appropriately.

@robertgendler commented on GitHub: Reviewing this again. If `mdmclient` does change and ends up being not the best method to check when an OS update or upgrade is released, we will update our checks appropriately.
michael commented 2026-01-19 18:29:19 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

We have found a handful of undocumented things within the project and test them between OS releases. mdmclient commands seem safe enough.

@robertgendler commented on GitHub: We have found a handful of undocumented things within the project and test them between OS releases. mdmclient commands seem safe enough.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#122
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?