usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

os_anti_virus_installed rule #169

New Issue
Closed
opened 2026-01-19 18:29:29 +00:00 by michael · 6 comments
michael commented 2026-01-19 18:29:29 +00:00
Owner
Copy Link

Originally created by @grismemj on GitHub.

Summary

The check looks for 1 instance of com.apple.XprotectFramework.PluginService$ or com.apple.XProtect.daemon.scan$, but there are actually 2 in current Ventura on Monterey installs.

Steps to reproduce

Run the check code on the command line when XProtect is active and it returns 2 instead of the 1 the rule is checking.

Operating System version

13.4, 13.5 beta, or 12.6.6

Intel or Apple Silicon

Both Intel and Apple Silicon

What is the current bug behavior?

Rules fails even though XProtect is active

What is the expected correct behavior?

Rule does not fail when XProtect is active

Relevant logs and/or screenshots

Fri Jun 2 16:07:58 UTC 2023 os_anti_virus_installed failed (Result: 2, Expected: {integer: 1})

Output of checks

Fri Jun 2 16:07:58 UTC 2023 os_anti_virus_installed failed (Result: 2, Expected: {integer: 1})

Possible fixes

Change the rule to check for 2

Originally created by @grismemj on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary The check looks for 1 instance of com.apple.XprotectFramework.PluginService$ or com.apple.XProtect.daemon.scan$, but there are actually 2 in current Ventura on Monterey installs. ### Steps to reproduce Run the check code on the command line when XProtect is active and it returns 2 instead of the 1 the rule is checking. ### Operating System version 13.4, 13.5 beta, or 12.6.6 ### Intel or Apple Silicon Both Intel and Apple Silicon ### What is the current *bug* behavior? Rules fails even though XProtect is active ### What is the expected *correct* behavior? Rule does not fail when XProtect is active ### Relevant logs and/or screenshots Fri Jun 2 16:07:58 UTC 2023 os_anti_virus_installed failed (Result: 2, Expected: {integer: 1}) ### Output of checks Fri Jun 2 16:07:58 UTC 2023 os_anti_virus_installed failed (Result: 2, Expected: {integer: 1}) ### Possible fixes Change the rule to check for 2
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@bernstei commented on GitHub:

@robertgendler any progress on this?

@bernstei commented on GitHub: @robertgendler any progress on this?
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@bernstei We'll try to fix it.

@robertgendler commented on GitHub: @bernstei We'll try to fix it.
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@bernstei commented on GitHub:

@robertgendler any thoughts on this monterey issue?

@bernstei commented on GitHub: @robertgendler any thoughts on this monterey issue?
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

This is fixed in I believe the ventura branch and for sure in dev_ventura_stig. We will be pushing these changes to main shortly.

@robertgendler commented on GitHub: This is fixed in I believe the `ventura` branch and for sure in `dev_ventura_stig`. We will be pushing these changes to `main` shortly.
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@bernstei commented on GitHub:

@robertgendler As of now, the monterey branch commit 9bfb62a22da1ad0f123a3182ef8c274a8ab14bba (HEAD -> monterey, origin/monterey) appears to fail in the same way. Is that expected somehow, or did this fix fail to make it to monterey?

@bernstei commented on GitHub: @robertgendler As of now, the `monterey` branch `commit 9bfb62a22da1ad0f123a3182ef8c274a8ab14bba (HEAD -> monterey, origin/monterey)` appears to fail in the same way. Is that expected somehow, or did this fix fail to make it to monterey?
michael commented 2026-01-19 18:29:29 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@bernstei all merged into monterey with the newest stig updates and all.

@robertgendler commented on GitHub: @bernstei all merged into monterey with the newest stig updates and all.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#169
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?