(dev_monterey) os_install_log_retention_policy and audit_flags_configure not remediating #256

New Issue

michael · 2026-01-19T18:29:50Z

michael commented

2026-01-19 18:29:50 +00:00

Originally created by @jordanburnette on GitHub.

Summary

Running os_install_log_retention_policy and audit_flags_configure rules from compliance script not remediating properly

Steps to reproduce

Build compliance.sh with the mentioned rules.
Upload to Jamf with the following added at the end to allow --check/--fix flags in Parameter 4 in the policy (use the --fix flag)

case $4 in
   --check)
       check=0
       run_scan
       ;;
   --fix)
       fix=0
       run_fix
       ;;
   *)
       exit 0
       ;;
esac

Run the policy on the targeted test machine and review the policy logs after completion

The checks seem to be working properly. For audit_flags_configure, it returns 0 and for os_install_log_retention_policy , the check returns No

Operating System version

macOS Monterey 12.1 (updating to 12.2.1 today)

What is the current bug behavior?

The problem is that since the fixes are not properly remediating the audit-point, the machine gets flagged as not meeting compliance and is tasked with continually running the fixes on each run.

What is the expected correct behavior?

The command to perform the fixes should complete properly so that the next scan returns the expected result values

Relevant logs and/or screenshots

Output from audit_flags_configure

Running the command to configure the settings for: audit_flags_configure ...
#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $
#
dir:/var/audit
flags:fm,ad,-ex,aa,-fr,lo,-fw
minfree:5
naflags:lo,aa
policy:cnt,argv
filesz:2M
expire-after:60d or 1G
superuser-set-sflags-mask:has_authenticated,has_console_access
superuser-clear-sflags-mask:has_authenticated,has_console_access
member-set-sflags-mask:
member-clear-sflags-mask:has_authenticated
Trigger sent.

Output from os_install_log_retention_policy

Running the command to configure the settings for: os_install_log_retention_configure ...
sed: -I or -i may not be used with stdin

Output of checks

Check from audit_flags_configure returns 0
Check from os_install_log_retention_policy No

This is likely due to the fixes not properly completing.

Possible fixes

Honestly not too sure. Not familiar with the commands that are being used for the fixes. Happy to test anything out as always!

Originally created by @jordanburnette on GitHub.  ### Summary Running `os_install_log_retention_policy` and `audit_flags_configure` rules from compliance script not remediating properly ### Steps to reproduce - Build compliance.sh with the mentioned rules. - Upload to Jamf with the following added at the end to allow --check/--fix flags in Parameter 4 in the policy (use the --fix flag) ```bash case $4 in --check) check=0 run_scan ;; --fix) fix=0 run_fix ;; *) exit 0 ;; esac ``` - Run the policy on the targeted test machine and review the policy logs after completion The checks seem to be working properly. For `audit_flags_configure`, it returns `0` and for `os_install_log_retention_policy` , the check returns `No` ### Operating System version macOS Monterey 12.1 (updating to 12.2.1 today) ### What is the current *bug* behavior? The problem is that since the fixes are not properly remediating the audit-point, the machine gets flagged as not meeting compliance and is tasked with continually running the fixes on each run. ### What is the expected *correct* behavior? The command to perform the fixes should complete properly so that the next scan returns the expected result values ### Relevant logs and/or screenshots - Output from `audit_flags_configure` ``` Running the command to configure the settings for: audit_flags_configure ... # # $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $ # dir:/var/audit flags:fm,ad,-ex,aa,-fr,lo,-fw minfree:5 naflags:lo,aa policy:cnt,argv filesz:2M expire-after:60d or 1G superuser-set-sflags-mask:has_authenticated,has_console_access superuser-clear-sflags-mask:has_authenticated,has_console_access member-set-sflags-mask: member-clear-sflags-mask:has_authenticated Trigger sent. ``` - Output from `os_install_log_retention_policy` ``` Running the command to configure the settings for: os_install_log_retention_configure ... sed: -I or -i may not be used with stdin ``` ### Output of checks - Check from `audit_flags_configure` returns `0` - Check from `os_install_log_retention_policy` `No` This is likely due to the fixes not properly completing. ### Possible fixes Honestly not too sure. Not familiar with the commands that are being used for the fixes. Happy to test anything out as always!

michael closed this issue

2026-01-19 18:29:50 +00:00

michael commented

2026-01-19 18:29:50 +00:00

@brodjieski commented on GitHub:

@jordanburnette I pushed some changes that should resolve the issues described here. When you get a chance, can you test to see if it fixes it for you?

Thanks!

@brodjieski commented on GitHub: @jordanburnette I pushed some changes that should resolve the issues described here. When you get a chance, can you test to see if it fixes it for you? Thanks!

michael commented

2026-01-19 18:29:50 +00:00

@jordanburnette commented on GitHub:

Can confirm the pushed fixes are verified as working. Thanks, Dan!

@jordanburnette commented on GitHub: Can confirm the pushed fixes are verified as working. Thanks, Dan!

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#256