usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Compliance script run with --fix does not apply fixes unless --check was run first #264

New Issue
Closed
opened 2026-01-19 18:29:51 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:29:51 +00:00
Owner
Copy Link

Originally created by @grismemj on GitHub.

Summary

Running the generated STIG compliance script with --fix does not actually fix issues unless --check was run first

Steps to reproduce

  1. Create a compliance script from the baseline STIG
  2. Run it with the --check option, the with the --fix option. Fixes will be applied to for the failed rules.
  3. Manually revert one of the fixes the script had made, i.e. remove one of the required sshd_config settings
  4. Run the compliance script with --fix again, it will simply report "os_sshd_fips_140_ciphers already configured, continuing..." for example, but will not actually apply the fix to sshd_config
  5. Run the compliance script with --check, and then with --fix, and the rule will applied to sshd_config as expected.

Operating System version

11.6.3

What is the current bug behavior?

Running the compliance script with --fix without running with --check first does not actually apply the rule fixes.

What is the expected correct behavior?

I expect if I run the compliance script with --fix, the rules will be applied. I don't see anything in the wiki that suggests --check must be run before --fix.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

Originally created by @grismemj on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary Running the generated STIG compliance script with --fix does not actually fix issues unless --check was run first ### Steps to reproduce 1. Create a compliance script from the baseline STIG 2. Run it with the --check option, the with the --fix option. Fixes will be applied to for the failed rules. 3. Manually revert one of the fixes the script had made, i.e. remove one of the required sshd_config settings 4. Run the compliance script with --fix again, it will simply report "os_sshd_fips_140_ciphers already configured, continuing..." for example, but will not actually apply the fix to sshd_config 5. Run the compliance script with --check, and then with --fix, and the rule will applied to sshd_config as expected. ### Operating System version 11.6.3 ### What is the current *bug* behavior? Running the compliance script with --fix without running with --check first does not actually apply the rule fixes. ### What is the expected *correct* behavior? I expect if I run the compliance script with --fix, the rules will be applied. I don't see anything in the wiki that suggests --check must be run before --fix. ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes (If you can, link to the line of code that might be responsible for the problem)
michael commented 2026-01-19 18:29:52 +00:00
Author
Owner
Copy Link

@grismemj commented on GitHub:

Ok, thanks. I wasn’t necessarily expecting this since the checks and fixes are usually just simple or compound commands…

From: Dan Brodjieski @.>
Date: Thursday, January 27, 2022 at 6:17 PM
To: usnistgov/macos_security @.>
Cc: GRISMER, MATTHEW J CIV USAF AFMC AFRL/RQVC @.>, Mention @.>
Subject: [URL Verdict: Neutral][Non-DoD Source] Re: [usnistgov/macos_security] Compliance script run with --fix does not apply fixes unless --check was run first (Issue #115)

Hi @grismemjhttps://github.com/grismemj In order for the script to run commands to fix settings, it must first know which settings need to be fixed. Running a compliance scan (check) will generate the findings that the remediation can act upon.

In production environments, one would typically run a SCAN, FIX, SCAN to complete the entire operation.

I have also updated the wiki page about the compliance script that touches on this.

—
Reply to this email directly, view it on GitHubhttps://github.com/usnistgov/macos_security/issues/115#issuecomment-1023728661, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AW6OSZIDMTPGTTJLLKDSF63UYHG6BANCNFSM5M7GDQAA.
Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
You are receiving this because you were mentioned.Message ID: @.***>

@grismemj commented on GitHub: Ok, thanks. I wasn’t necessarily expecting this since the checks and fixes are usually just simple or compound commands… From: Dan Brodjieski ***@***.***> Date: Thursday, January 27, 2022 at 6:17 PM To: usnistgov/macos_security ***@***.***> Cc: GRISMER, MATTHEW J CIV USAF AFMC AFRL/RQVC ***@***.***>, Mention ***@***.***> Subject: [URL Verdict: Neutral][Non-DoD Source] Re: [usnistgov/macos_security] Compliance script run with --fix does not apply fixes unless --check was run first (Issue #115) Hi @grismemj<https://github.com/grismemj> In order for the script to run commands to fix settings, it must first know which settings need to be fixed. Running a compliance scan (check) will generate the findings that the remediation can act upon. In production environments, one would typically run a SCAN, FIX, SCAN to complete the entire operation. I have also updated the wiki page about the compliance script that touches on this. — Reply to this email directly, view it on GitHub<https://github.com/usnistgov/macos_security/issues/115#issuecomment-1023728661>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AW6OSZIDMTPGTTJLLKDSF63UYHG6BANCNFSM5M7GDQAA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: ***@***.***>
michael commented 2026-01-19 18:29:52 +00:00
Author
Owner
Copy Link

@brodjieski commented on GitHub:

Hi @grismemj In order for the script to run commands to fix settings, it must first know which settings need to be fixed. Running a compliance scan (check) will generate the findings that the remediation can act upon.

In production environments, one would typically run a SCAN, FIX, SCAN to complete the entire operation.

I have also updated the wiki page about the compliance script that touches on this.

@brodjieski commented on GitHub: Hi @grismemj In order for the script to run commands to fix settings, it must first know which settings need to be fixed. Running a compliance scan (check) will generate the findings that the remediation can act upon. In production environments, one would typically run a SCAN, FIX, SCAN to complete the entire operation. I have also updated the wiki page about the compliance script that touches on this.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#264
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?