audit_flags_fm_configure fails in dev_sonoma because of the ^fm #152

New Issue

michael · 2026-01-19T18:29:25Z

michael commented

2026-01-19 18:29:25 +00:00

Originally created by @cipineda on GitHub.

Summary

I did find a similar issue (#73) but it is way too old.
audit_flags_fm_configure fails all the time even if the -fm flag is in the file and I think it is because of the '^fm' code.

Steps to reproduce

In Sonoma 14.0 Beta 7 (23A5337a) one running the following code it always returns 0.
Run: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm'

Operating System version

Sonoma 14.0 Beta 7 (23A5337a)

Intel or Apple Silicon

Silicon and Intel

What is the current bug behavior?

validation script returns 0 even if the audit file does have the -fm flag

What is the expected correct behavior?

Validation script should return 1

Relevant logs and/or screenshots

Output of checks

/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm'
0

Possible fixes

/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'fm'
OR
/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '-fm'

Originally created by @cipineda on GitHub.  ### Summary I did find a similar issue (#73) but it is way too old. audit_flags_fm_configure fails all the time even if the -fm flag is in the file and I think it is because of the `'^fm'` code. ### Steps to reproduce In Sonoma 14.0 Beta 7 (23A5337a) one running the following code it always returns 0. Run: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm' ### Operating System version Sonoma 14.0 Beta 7 (23A5337a) ### Intel or Apple Silicon Silicon and Intel ### What is the current *bug* behavior? validation script returns 0 even if the audit file does have the -fm flag ### What is the expected *correct* behavior? Validation script should return 1 ### Relevant logs and/or screenshots ### Output of checks `/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm'` `0` ### Possible fixes `/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'fm' ` OR `/usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '-fm' `

michael closed this issue

2026-01-19 18:29:25 +00:00

michael commented

2026-01-19 18:29:25 +00:00

@cipineda commented on GitHub:

Here it is.

`P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8`

dir:/var/audit
flags:lo,aa,ad,-ex,-fd,-fm,-fr,-fw
minfree:25
naflags:lo,aa
policy: ahlt,argv
filesz:2M
expire-after:7d
superuser-set-sflags-mask:has_authenticated,has_console_access
superuser-clear-sflags-mask:has_authenticated,has_console_access
member-set-sflags-mask:
member-clear-sflags-mask:has_authenticated

@cipineda commented on GitHub: Here it is. # # $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $ # dir:/var/audit flags:lo,aa,ad,-ex,-fd,-fm,-fr,-fw minfree:25 naflags:lo,aa policy: ahlt,argv filesz:2M expire-after:7d superuser-set-sflags-mask:has_authenticated,has_console_access superuser-clear-sflags-mask:has_authenticated,has_console_access member-set-sflags-mask: member-clear-sflags-mask:has_authenticated

michael commented

2026-01-19 18:29:25 +00:00

@cipineda commented on GitHub:

The rule Im using and reporting in this issue is audit_flags_fm_configure and it failed as coded, until I modified the proposed code above, then it marked the finding as passed.

@cipineda commented on GitHub: The rule Im using and reporting in this issue is `audit_flags_fm_configure` and it failed as coded, until I modified the proposed code above, then it marked the finding as passed.

michael commented

2026-01-19 18:29:25 +00:00

@brodjieski commented on GitHub:

Can you share your configuration in /etc/security/audit_control?

@brodjieski commented on GitHub: Can you share your configuration in `/etc/security/audit_control`?

michael commented

2026-01-19 18:29:25 +00:00

@brodjieski commented on GitHub:

That configuration does not contain the fm flag, and will fail the check for audit_flags_fm_configure.

I see you have -fm which will pass the check for audit_flags_fm_failed_configure, but will not pass the other. With audit flags fm is not the same as -fm.

@brodjieski commented on GitHub: That configuration does not contain the `fm` flag, and will fail the check for `audit_flags_fm_configure`. I see you have `-fm` which will pass the check for `audit_flags_fm_failed_configure`, but will not pass the other. With audit flags `fm` is not the same as `-fm`.

michael commented

2026-01-19 18:29:25 +00:00

@brodjieski commented on GitHub:

There are 2 different rules that touch upon the fm flag for auditing. One is audit_flags_fm_configure and the other is audit_flags_fm_failed_configure.

The rule referenced in this issue is audit_flags_fm_configure which is looking for fm in the flags, and will fail if only -fm exists in the flags.

The other rule audit_flags_fm_failed_configure is checking for -fm.

Depending on which rule you are including in your baseline, it should pass if configured correctly as written.

@brodjieski commented on GitHub: There are 2 different rules that touch upon the `fm` flag for auditing. One is `audit_flags_fm_configure` and the other is `audit_flags_fm_failed_configure`. The rule referenced in this issue is `audit_flags_fm_configure` which is looking for `fm` in the flags, and will fail if only `-fm` exists in the flags. The other rule `audit_flags_fm_failed_configure` is checking for `-fm`. Depending on which rule you are including in your baseline, it should pass if configured correctly as written.

michael commented

2026-01-19 18:29:25 +00:00

@cipineda commented on GitHub:

Are you saying that the flags: should not have a dash at all?

@cipineda commented on GitHub: Are you saying that the flags: should not have a dash at all?

michael commented

2026-01-19 18:29:25 +00:00

@brodjieski commented on GitHub:

Flags can include a dash, along with other modifiers, according to the audit_control man page. Flags with a - indicate it will only log failed events. We have 2 rules in the project that cover the file modification (fm) events. One is to capture all audit events, and the other is to capture failed.

The rule audit_flags_fm_configure is to capture them all... fm
The rule audit_flags_fm_failed_configure is to capture the failed... -fm

Depending on which rule you want to include in your baseline, that will result in which configuration you need to pass the check.

If you want to pass the audit_flags_fm_configure rule, your configuration needs to include fm in the flags.
If you want to pass the audit_flags_fm_failed_configure rule, your configuration needs to include -fm in the flags.

@brodjieski commented on GitHub: Flags can include a dash, along with other modifiers, according to the `audit_control` man page. Flags with a `-` indicate it will only log failed events. We have 2 rules in the project that cover the file modification (fm) events. One is to capture all audit events, and the other is to capture failed. The rule `audit_flags_fm_configure` is to capture them all... `fm` The rule `audit_flags_fm_failed_configure` is to capture the failed... `-fm` Depending on which rule you want to include in your baseline, that will result in which configuration you need to pass the check. If you want to pass the `audit_flags_fm_configure` rule, your configuration needs to include `fm` in the flags. If you want to pass the `audit_flags_fm_failed_configure` rule, your configuration needs to include `-fm` in the flags.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#152