usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

os_anti_virus_installed returns unexpected result ('integer': 3) #186

New Issue
Closed
opened 2026-01-19 18:29:34 +00:00 by michael · 3 comments
michael commented 2026-01-19 18:29:34 +00:00
Owner
Copy Link

Originally created by @qharouff on GitHub.

Originally assigned to: @robertgendler on GitHub.

Summary

We are seeing the "os_anti_virus_installed" check fail in our mSCP deployment on a subset of macOS devices with the returned value 'integer': 3

Steps to reproduce

Running /bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan)" returns three 'com.apple.XProtect' related values:

  • com.apple.XprotectFramework.PluginService
  • com.apple.XProtect.daemon.scan
  • com.apple.XProtect.daemon.scan.startup

Operating System version

Behavior is seen on a range of Ventura OS versions including 13.1, 13.2, 13.2.1 (mSCP Ventura Deployment). However, there are devices with controls applied that do that exhibit this behavior on these versions of macOS.

Intel or Apple Silicon

Occurs on both Apple Silicon & Intel.

What is the current bug behavior?

A third 'com.apple.XProtect.daemon.scan.startup' launchctl item appears on some devices which fails the default count of '2' when an integer of '3' is returned. The /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan) command within the check is picking up 'com.apple.XProtect.daemon.scan.startup' as it contains the string 'com.apple.XProtect.daemon.scan'.

What is the expected correct behavior?

'com.apple.XprotectFramework.PluginService' and 'com.apple.XProtect.daemon.scan' are the two launchctl items checked by this control by default.

Relevant logs and/or screenshots

Terminal Output:

sudo /bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan)" 

657	0	com.apple.XprotectFramework.PluginService
-	0	com.apple.XProtect.daemon.scan.startup
23608	0	com.apple.XProtect.daemon.scan

Output of checks

Wed Mar 22 15:01:48 UTC 2023 os_anti_virus_installed failed (Result: 3, Expected: {integer: 2})

Possible fixes

The check could be modified to check if returned value is equal to or greater than 2. Or, the grep command within the check could be modified to extract 'com.apple.XProtect.daemon.scan' without capturing 'com.apple.XProtect.daemon.scan.startup'.

Please let me know if there's any further relevant information I can provide! Happy to do some testing.

Originally created by @qharouff on GitHub. Originally assigned to: @robertgendler on GitHub. ### Summary We are seeing the "os_anti_virus_installed" check fail in our mSCP deployment on a subset of macOS devices with the returned value 'integer': 3 ### Steps to reproduce Running `/bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan)"` returns three 'com.apple.XProtect' related values: - com.apple.XprotectFramework.PluginService - com.apple.XProtect.daemon.scan - com.apple.XProtect.daemon.scan.startup ### Operating System version Behavior is seen on a range of Ventura OS versions including 13.1, 13.2, 13.2.1 (mSCP Ventura Deployment). However, there are devices with controls applied that do that exhibit this behavior on these versions of macOS. ### Intel or Apple Silicon Occurs on both Apple Silicon & Intel. ### What is the current *bug* behavior? A third 'com.apple.XProtect.daemon.scan.startup' launchctl item appears on some devices which fails the default count of '2' when an integer of '3' is returned. The `/usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan)` command within the check is picking up 'com.apple.XProtect.daemon.scan.startup' as it contains the string 'com.apple.XProtect.daemon.scan'. ### What is the expected *correct* behavior? 'com.apple.XprotectFramework.PluginService' and 'com.apple.XProtect.daemon.scan' are the two launchctl items checked by this control by default. ### Relevant logs and/or screenshots Terminal Output: ``` sudo /bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService|com.apple.XProtect.daemon.scan)" 657 0 com.apple.XprotectFramework.PluginService - 0 com.apple.XProtect.daemon.scan.startup 23608 0 com.apple.XProtect.daemon.scan ``` ### Output of checks `Wed Mar 22 15:01:48 UTC 2023 os_anti_virus_installed failed (Result: 3, Expected: {integer: 2})` ### Possible fixes The check could be modified to check if returned value is equal to or greater than 2. Or, the grep command within the check could be modified to extract 'com.apple.XProtect.daemon.scan' without capturing 'com.apple.XProtect.daemon.scan.startup'. Please let me know if there's any further relevant information I can provide! Happy to do some testing.
michael commented 2026-01-19 18:29:34 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Merged into the ventura branch.

@robertgendler commented on GitHub: Merged into the `ventura` branch.
michael commented 2026-01-19 18:29:34 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

/bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService$|com.apple.XProtect.daemon.scan$)"

We'll update the check to this and test

@robertgendler commented on GitHub: `/bin/launchctl list | /usr/bin/grep -E "(com.apple.XprotectFramework.PluginService$|com.apple.XProtect.daemon.scan$)"` We'll update the check to this and test
michael commented 2026-01-19 18:29:34 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

And merged into monterey as well.

@robertgendler commented on GitHub: And merged into `monterey` as well.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#186
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?