mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 05:53:24 +00:00
Firmware password check does not work on Apple Silicon-based machines. #266
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @grismemj on GitHub.
Summary
The existing check for a firmware password fails on Apple Silicon-based Macs.
Steps to reproduce
sudo firmwarepasswd -check returns
ERROR | SetupTRBSettings | The firmware on this machine is not supported.
on Apple Silicon-based hardware.
Operating System version
11.6.2
What is the current bug behavior?
sudo firmwarepasswd -check returns
ERROR | SetupTRBSettings | The firmware on this machine is not supported.
and the rule fails.
What is the expected correct behavior?
There is no firmware password on Apple Silicon hardware, so the rule should not fail. It should detect the hardware and always pass for Apple Silicon hardware.
Relevant logs and/or screenshots
(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)
Output of checks
(Paste any output that occurs with the bug)
Possible fixes
Check the hardware, and only run the firmwarepasswd -check on Intel, otherwise just return 1.
[[
uname -m== "x86_64" ]] && /usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes" || echo 1@0xmachos commented on GitHub:
via Set a firmware password on your Mac
@brodjieski commented on GitHub:
While we do include a note about applicability in the os_firmware_password_require rule, we also tag the rule with a -i386 tag to indicate that is should only apply to Intel based systems. This tag should be referenced when creating the compliance script, however, there is currently a bug with generate_guidance.py that needs to be addressed.