mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
Modifications to "authorizationdb" in 2.6.8 cause other commands to fail when run by root, sudo or by an mdm agent #22
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jbracy-0724 on GitHub.
Summary
The method provided by CIS for macOS 15 remediation of "2.6.8 Ensure an Administrator Password Is Required to Access
System-Wide Preferences (Automated)" causes other commands to fail when run by root or by an MDM agent. Specifically we discovered that any scripts using dsconfigad or sysadminctl would fail with an error "errAuthorizationInteractionNotAllowed: The authorization was denied since no user interaction was possible."
We discovered that the modifications to the authorizationdb prevented non-interactive sessions. Ironically it would also cause other CIS remediations using sysadminctl to fail when running with sudo. Although the same command run without sudo by an admin user would prompt for admin password and would complete.
Further we discovered that deploying a directory profile via MDM would fail to connect the device to Active Directory.
The only recourse we had was to reset the authorizationsdb with "security authorizationdb reset", and then re-applying rules that we require. Once this was done, scripts and profiles began working as expected again.
Steps to reproduce
Apply the remediation script for issue "2.6.8 Ensure an Administrator Password Is Required to Access
System-Wide Preferences (Automated)"
Operating System version
15.6.1 (24G90)
Intel or Apple Silicon
Apple Silicon Mac
What is the current bug behavior?
Scripts using dsconfigad or sysadminctl will fail when run as purt of a script, as root, or with sudo
What is the expected correct behavior?
the commands should run without any errors.
Relevant logs and/or screenshots
(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)
Output of checks
"errAuthorizationInteractionNotAllowed: The authorization was denied since no user interaction was possible."
Possible fixes
reset the authorizationdb using "security authorizationdb reset"
@brodjieski commented on GitHub:
Closing issue due to inactivity. Feel free to re-open if additional details are available.
@brodjieski commented on GitHub:
Can you provide an example script along with any relevant log files? I am unable to reproduce the issue as described.
Also, can you confirm if you have any privilege management tools installed on your systems? BeyondTrust comes to mind when encountering behavior tied to the authorization db.