sysprefs_system_wide_preferences_configure shared key doesn't exist on some systems #224

New Issue

michael · 2026-01-19T18:29:43Z

michael commented

2026-01-19 18:29:43 +00:00

Originally created by @TSPARR on GitHub.

Summary

On some systems, the shared key does not exist in the output from /usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist

Steps to reproduce

I am unaware of how systems get into this state as it appears to be a non-standard configuration; however, I have seen multiple systems throughout our client base in this state. To emulate such a system, after outputting to /tmp/system.preferences.plist, you can pause and edit the file to remove the shared key manually. From there, attempting to run /usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist fails and the finding is not remediated.

Operating System version

12.6.0 (21G115)

What is the current bug behavior?

The finding is not remediated and the shared key is not created.

What is the expected correct behavior?

The finding should be remediated regardless including creating the key if it does not already exists.

Relevant logs and/or screenshots

YES (0)
Set: Entry, ":shared", Does Not Exist
YES (0)

Output of checks

Wed Oct  5 14:59:59 UTC 2022 sysprefs_system_wide_preferences_configure failed (Result: 0, Expected: {integer: 1})

Possible fixes

Doing a check for the existence of the key and created it if it doesn't exist should prevent this issue going forward for those systems which are in this state. There's likely a better way to check for its existence than mine; however, this code does work as expected.

/usr/bin/security authorizationdb read system.preferences >/tmp/system.preferences.plist
key_value=$(/usr/libexec/PlistBuddy -c "Print :shared" /tmp/system.preferences.plist)
if [[ "$key_value" == *"Does Not Exist"* ]]; then
    /usr/libexec/PlistBuddy -c "Add :shared bool false" /tmp/system.preferences.plist
fi
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
/usr/bin/security authorizationdb write system.preferences </tmp/system.preferences.plist

Originally created by @TSPARR on GitHub. ### Summary On some systems, the `shared` key does not exist in the output from `/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist` ### Steps to reproduce I am unaware of how systems get into this state as it appears to be a non-standard configuration; however, I have seen multiple systems throughout our client base in this state. To emulate such a system, after outputting to `/tmp/system.preferences.plist`, you can pause and edit the file to remove the `shared` key manually. From there, attempting to run `/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist` fails and the finding is not remediated. ### Operating System version 12.6.0 (21G115) ### What is the current *bug* behavior? The finding is not remediated and the `shared` key is not created. ### What is the expected *correct* behavior? The finding should be remediated regardless including creating the key if it does not already exists. ### Relevant logs and/or screenshots ``` YES (0) Set: Entry, ":shared", Does Not Exist YES (0) ``` ### Output of checks ``` Wed Oct 5 14:59:59 UTC 2022 sysprefs_system_wide_preferences_configure failed (Result: 0, Expected: {integer: 1}) ``` ### Possible fixes Doing a check for the existence of the key and created it if it doesn't exist should prevent this issue going forward for those systems which are in this state. There's likely a better way to check for its existence than mine; however, this code does work as expected. ``` /usr/bin/security authorizationdb read system.preferences >/tmp/system.preferences.plist key_value=$(/usr/libexec/PlistBuddy -c "Print :shared" /tmp/system.preferences.plist) if [[ "$key_value" == *"Does Not Exist"* ]]; then /usr/libexec/PlistBuddy -c "Add :shared bool false" /tmp/system.preferences.plist fi /usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist /usr/bin/security authorizationdb write system.preferences </tmp/system.preferences.plist ```

michael closed this issue

2026-01-19 18:29:43 +00:00

michael commented

2026-01-19 18:29:43 +00:00

@robertgendler commented on GitHub:

Solved by PR #178 and #179

@robertgendler commented on GitHub: Solved by PR #178 and #179

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#224