Add command to remove uchg flag from /etc/security/audit_control #189

New Issue

michael · 2026-01-19T18:29:34Z

michael commented

2026-01-19 18:29:34 +00:00

Originally created by @brodjieski on GitHub.

Originally assigned to: @robertgendler on GitHub.

Discussed in https://github.com/usnistgov/macos_security/discussions/235

^{Originally posted by MatimusPrime March 8, 2023}
I have been trying to work my way through these as a proof of concept but this one and a few after it that all ask to modify the

/etc/security/audit_control

all fail with Operation not permitted running as sudo
the file itself shows system as readonly and everyone as No Access.

Is this common or many due to another piece of security software we may have?

Originally created by @brodjieski on GitHub. Originally assigned to: @robertgendler on GitHub. ### Discussed in https://github.com/usnistgov/macos_security/discussions/235 <div type='discussions-op-text'> <sup>Originally posted by **MatimusPrime** March 8, 2023</sup> I have been trying to work my way through these as a proof of concept but this one and a few after it that all ask to modify the /etc/security/audit_control all fail with Operation not permitted running as sudo the file itself shows system as readonly and everyone as No Access. Is this common or many due to another piece of security software we may have? </div>

michael closed this issue

2026-01-19 18:29:34 +00:00

michael commented

2026-01-19 18:29:35 +00:00

@jmahlman commented on GitHub:

As you already know..apps like compliance reporter (formerly cmdReporter) change the permissions in this folder. In my case, I added a custom rule to fix this and that's usually the best COA.

Maybe we should just run the command no matter what..

@jmahlman commented on GitHub: As you already know..apps like compliance reporter (formerly cmdReporter) change the permissions in this folder. In my case, I added a custom rule to fix this and that's usually the best COA. Maybe we should just run the command no matter what..

michael commented

2026-01-19 18:29:35 +00:00

@robertgendler commented on GitHub:

Merged into os branches

@robertgendler commented on GitHub: Merged into os branches

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#189

Add command to remove uchg flag from /etc/security/audit_control #189

Discussed in https://github.com/usnistgov/macos_security/discussions/235

Add command to remove `uchg` flag from /etc/security/audit_control #189