usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Mobileconfig profiles do not honor compliance script exemptions #265

New Issue
Closed
opened 2026-01-19 18:29:52 +00:00 by michael · 1 comment
michael commented 2026-01-19 18:29:52 +00:00
Owner
Copy Link

Originally created by @grismemj on GitHub.

Summary

The mobileconfig profiles created by the project do not reflect the exemptions listed in the org.{baseline}.audit.plist file.

Steps to reproduce

Create a baseline, edit the org.{baseline}.audit.plist exempting some rules, and copy it to /Library/Preferences. Generate the mobileconfig profiles with generate_guidance.py -p option, the profiles still contain the settings for the exempted rules.

Operating System version

11.6.2

What is the current bug behavior?

The mobileconfig profiles appear to be fixed, and do not honor exemptions placed in the org.{baseline}.audit.plist file.

What is the expected correct behavior?

The mobileconfig profiles should not contain settings for rules that have been exempted in the org.{baseline}.audit.plist file.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

Originally created by @grismemj on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary The mobileconfig profiles created by the project do not reflect the exemptions listed in the org.{baseline}.audit.plist file. ### Steps to reproduce Create a baseline, edit the org.{baseline}.audit.plist exempting some rules, and copy it to /Library/Preferences. Generate the mobileconfig profiles with generate_guidance.py -p option, the profiles still contain the settings for the exempted rules. ### Operating System version 11.6.2 ### What is the current *bug* behavior? The mobileconfig profiles appear to be fixed, and do not honor exemptions placed in the org.{baseline}.audit.plist file. ### What is the expected *correct* behavior? The mobileconfig profiles should not contain settings for rules that have been exempted in the org.{baseline}.audit.plist file. ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes (If you can, link to the line of code that might be responsible for the problem)
michael commented 2026-01-19 18:29:52 +00:00
Author
Owner
Copy Link

@brodjieski commented on GitHub:

Thanks for your feedback!

The .plist file that is used for exemptions (org.{baseline}.audit.plist) is processed during the execution of the {baseline}_compliance.sh. That .plist is not used by the generate_guidance.py script (it's actually created during the guidance generation). If you would like to exclude settings from the generated .mobileconfig files, you will need to remove the associated rules from the {baseline}.yaml file before running generate_guidance.py.

More information about exemptions can be found here.

@brodjieski commented on GitHub: Thanks for your feedback! The .plist file that is used for exemptions (org.{baseline}.audit.plist) is processed during the execution of the {baseline}_compliance.sh. That .plist is not used by the generate_guidance.py script (it's actually created during the guidance generation). If you would like to exclude settings from the generated .mobileconfig files, you will need to remove the associated rules from the {baseline}.yaml file before running generate_guidance.py. More information about exemptions can be found [here.](https://github.com/usnistgov/macos_security/wiki/Compliance-Script)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#265
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?