usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

os_hibernate_mode_enable: Standby setting for Apple silicon is incorrect #199

New Issue
Closed
opened 2026-01-19 18:29:37 +00:00 by michael · 6 comments
michael commented 2026-01-19 18:29:37 +00:00
Owner
Copy Link

Originally created by @jmahlman on GitHub.

Summary

The check and fix for Apple silicon devices is incorrectly checking for standbydelay instead of standby.
The key standbydelay does not work on Apple silicon and instead the delay is simply set with the standby key.

Operating System version

macOS Monterey and macOS Ventura

Intel or Apple Silicon

Apple Silicon

What is the current bug behavior?

The current check is looking at the value of standbydelay which does not exist on Apple silicon devices.
The current fix is setting standbydelay which does not exist on Apple silicon devices.

What is the expected correct behavior?

The check and fix should be checking and setting the standby key.

Possible fixes

Update the fix and check:

check: |
  error_count=0
  if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -q "MacBook"; then
    hibernateMode=$(/usr/bin/pmset -b -g | /usr/bin/grep hibernatemode 2>&1 | /usr/bin/awk '{print $2}')
    if [[ "$(/usr/sbin/sysctl -n machdep.cpu.brand_string)" =~ "Intel" ]]; then
        hibernateStandbyLowValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelaylow 2>&1 | /usr/bin/awk '{print $2}')
        hibernateStandbyHighValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelayhigh 2>&1 | /usr/bin/awk '{print $2}')
        hibernateStandbyThreshValue=$(/usr/bin/pmset -g | /usr/bin/grep highstandbythreshold 2>&1 | /usr/bin/awk '{print $2}')
        
        if [[ "$hibernateStandbyLowValue" == "" ]] || [[ "$hibernateStandbyLowValue" -gt 600 ]]; then
            ((error_count++))
        fi
        if [[ "$hibernateStandbyHighValue" == "" ]] || [[ "$hibernateStandbyHighValue" -gt 600 ]]; then
            ((error_count++))
        fi
        if [[ "$hibernateStandbyThreshValue" == "" ]] || [[ "$hibernateStandbyThreshValue" -lt 90 ]]; then
            ((error_count++))
        fi
    fi
    if [[ "$hibernateMode" == "" ]] || [[ "$hibernateMode" != 25 ]]; then
      ((error_count++))
    fi
  fi
  echo "$error_count"
result:
  integer: 0
fix: |
  [source,bash]
  ----
  /usr/bin/pmset -a hibernatemode 25
  if [[ "$(/usr/sbin/sysctl -n machdep.cpu.brand_string)" =~ "Intel" ]]; then
    /usr/bin/pmset -a standbydelayhigh 600
    /usr/bin/pmset -a standbydelaylow 600
    /usr/bin/pmset -a highstandbythreshold 90
  fi
  ----
Originally created by @jmahlman on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary The check and fix for Apple silicon devices is incorrectly checking for `standbydelay` instead of `standby`. The key `standbydelay` does not work on Apple silicon and instead the delay is simply set with the `standby` key. ### Operating System version macOS Monterey and macOS Ventura ### Intel or Apple Silicon Apple Silicon ### What is the current *bug* behavior? The current check is looking at the value of `standbydelay` which does not exist on Apple silicon devices. The current fix is setting `standbydelay` which does not exist on Apple silicon devices. ### What is the expected *correct* behavior? The check and fix should be checking and setting the `standby` key. ### Possible fixes Update the fix and check: ```yaml check: | error_count=0 if /usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>&1 | /usr/bin/grep -q "MacBook"; then hibernateMode=$(/usr/bin/pmset -b -g | /usr/bin/grep hibernatemode 2>&1 | /usr/bin/awk '{print $2}') if [[ "$(/usr/sbin/sysctl -n machdep.cpu.brand_string)" =~ "Intel" ]]; then hibernateStandbyLowValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelaylow 2>&1 | /usr/bin/awk '{print $2}') hibernateStandbyHighValue=$(/usr/bin/pmset -g | /usr/bin/grep standbydelayhigh 2>&1 | /usr/bin/awk '{print $2}') hibernateStandbyThreshValue=$(/usr/bin/pmset -g | /usr/bin/grep highstandbythreshold 2>&1 | /usr/bin/awk '{print $2}') if [[ "$hibernateStandbyLowValue" == "" ]] || [[ "$hibernateStandbyLowValue" -gt 600 ]]; then ((error_count++)) fi if [[ "$hibernateStandbyHighValue" == "" ]] || [[ "$hibernateStandbyHighValue" -gt 600 ]]; then ((error_count++)) fi if [[ "$hibernateStandbyThreshValue" == "" ]] || [[ "$hibernateStandbyThreshValue" -lt 90 ]]; then ((error_count++)) fi fi if [[ "$hibernateMode" == "" ]] || [[ "$hibernateMode" != 25 ]]; then ((error_count++)) fi fi echo "$error_count" result: integer: 0 fix: | [source,bash] ---- /usr/bin/pmset -a hibernatemode 25 if [[ "$(/usr/sbin/sysctl -n machdep.cpu.brand_string)" =~ "Intel" ]]; then /usr/bin/pmset -a standbydelayhigh 600 /usr/bin/pmset -a standbydelaylow 600 /usr/bin/pmset -a highstandbythreshold 90 fi ---- ```
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@vaughnhart commented on GitHub:

sudo pmset -a destroyfvkeyonstandby 1
sudo pmset -a hibernatemode 25
sudo pmset -a powernap 0
sudo pmset -a standby 0
sudo pmset -a standbydelay 0
sudo pmset -a autopoweroff 0

this is my pmset -g

System-wide power settings:
DestroyFVKeyOnStandby 1
Currently in use:
standby 0
Sleep On Power Button 1
SleepServices 0
hibernatefile /var/vm/sleepimage
powernap 0
networkoversleep 0
disksleep 10
sleep 1 (sleep prevented by powerd)
hibernatemode 25
ttyskeepawake 1
displaysleep 10
tcpkeepalive 1
lowpowermode 0
womp 0

@vaughnhart commented on GitHub: sudo pmset -a destroyfvkeyonstandby 1 sudo pmset -a hibernatemode 25 sudo pmset -a powernap 0 sudo pmset -a standby 0 sudo pmset -a standbydelay 0 sudo pmset -a autopoweroff 0 this is my pmset -g System-wide power settings: DestroyFVKeyOnStandby 1 Currently in use: standby 0 Sleep On Power Button 1 SleepServices 0 hibernatefile /var/vm/sleepimage powernap 0 networkoversleep 0 disksleep 10 sleep 1 (sleep prevented by powerd) hibernatemode 25 ttyskeepawake 1 displaysleep 10 tcpkeepalive 1 lowpowermode 0 womp 0
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@jmahlman commented on GitHub:

I have opened an Apple enterprise case to get clarification on what standby actually does and expects. It seems that it should be a boolean, but I cannot see any difference on the endpoint with it set or not.

@jmahlman commented on GitHub: I have opened an Apple enterprise case to get clarification on what `standby` actually does and expects. It seems that it should be a boolean, but I cannot see any difference on the endpoint with it set or not.
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@jmahlman commented on GitHub:

Setting hibernatemode to 25 does work on Apple silicon, so that can remain. I have updated my check/fix in the original post.

@jmahlman commented on GitHub: Setting `hibernatemode` to 25 does work on Apple silicon, so that can remain. I have updated my check/fix in the original post.
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@jmahlman any updates?

@robertgendler commented on GitHub: @jmahlman any updates?
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@jmahlman commented on GitHub:

Clarification from Apple:

I did some digging on this and “standby” on Apple silicon systems is not applicable at all. While the command option is there because it is built in to macOS, it does not actually affect anything on Apple silicon.
“standby” is a style of hibernation optimized for fast wake times. Apple silicon machines do not support hibernation beyond a basic method that is automatically applied when an Apple silicon machines battery gets too low. Since hibernation is not supported on Apple silicon machines, the use of standby will see no tangible effects on Apple silicon systems.
To avoid needing to run “pmset -a standby” on Apple silicon systems it may be worth while to add logic into the scripts that checks for the arm64 system type and then ignore the need to leverage that command.

So it seems this may not actually be a check we need. I'm getting clarification on hibernatemode as well.

@jmahlman commented on GitHub: Clarification from Apple: > I did some digging on this and “standby” on Apple silicon systems is not applicable at all. While the command option is there because it is built in to macOS, it does not actually affect anything on Apple silicon. “standby” is a style of hibernation optimized for fast wake times. Apple silicon machines do not support hibernation beyond a basic method that is automatically applied when an Apple silicon machines battery gets too low. Since hibernation is not supported on Apple silicon machines, the use of standby will see no tangible effects on Apple silicon systems. To avoid needing to run “pmset -a standby” on Apple silicon systems it may be worth while to add logic into the scripts that checks for the arm64 system type and then ignore the need to leverage that command. So it seems this may not actually be a check we need. I'm getting clarification on `hibernatemode` as well.
michael commented 2026-01-19 18:29:38 +00:00
Author
Owner
Copy Link

@jmahlman commented on GitHub:

Fixes pushed to OS branches.

@jmahlman commented on GitHub: Fixes pushed to OS branches.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#199
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?