big_sur branch has two rules that claim to be APPL-11-000001 #277

New Issue

michael · 2026-01-19T18:29:54Z

michael commented

2026-01-19 18:29:54 +00:00

Originally created by @bernstei on GitHub.

Summary

Both sysprefs_apple_watch_unlock_disable.yaml and sysprefs_touchid_unlock_disable.yaml claim to correspond to STIG ID APPL-11-000001

Steps to reproduce

grep APPL-11-000001 rules/*/*

Operating System version

11.5.1

What is the current bug behavior?

two rules with same STIG ID despite addressing different settings and vulnerabilities (touchID vs. Apple Watch unlock)

What is the expected correct behavior?

one rule per STIG ID (in general, but definitely for this particular STIG ID)

Relevant logs and/or screenshots

> egrep 'APPL-11-000001|touch|watch' rules/*/*
rules/os/os_touchid_prompt_disable.yaml:id: os_touchid_prompt_disable
rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml:id: sysprefs_apple_watch_unlock_disable
rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml:  Disabling Apple watches is a necessary step to ensuring that the information system retains a session lock until the user reestablishes access using an authorized identification and authentication procedures.
rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml:    - APPL-11-000001
rules/sysprefs/sysprefs_touchid_unlock_disable.yaml:id: sysprefs_touchid_unlock_disable
rules/sysprefs/sysprefs_touchid_unlock_disable.yaml:    - APPL-11-000001

I suspect there may be additional conflicts (in labeling and/or tagging) with the STIG rules for touchid and apple watch, but haven't checked carefully.

Originally created by @bernstei on GitHub. ### Summary Both `sysprefs_apple_watch_unlock_disable.yaml` and `sysprefs_touchid_unlock_disable.yaml` claim to correspond to STIG ID APPL-11-000001 ### Steps to reproduce `grep APPL-11-000001 rules/*/*` ### Operating System version 11.5.1 ### What is the current *bug* behavior? two rules with same STIG ID despite addressing different settings and vulnerabilities (touchID vs. Apple Watch unlock) ### What is the expected *correct* behavior? one rule per STIG ID (in general, but definitely for this particular STIG ID) ### Relevant logs and/or screenshots ``` > egrep 'APPL-11-000001|touch|watch' rules/*/* rules/os/os_touchid_prompt_disable.yaml:id: os_touchid_prompt_disable rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml:id: sysprefs_apple_watch_unlock_disable rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml: Disabling Apple watches is a necessary step to ensuring that the information system retains a session lock until the user reestablishes access using an authorized identification and authentication procedures. rules/sysprefs/sysprefs_apple_watch_unlock_disable.yaml: - APPL-11-000001 rules/sysprefs/sysprefs_touchid_unlock_disable.yaml:id: sysprefs_touchid_unlock_disable rules/sysprefs/sysprefs_touchid_unlock_disable.yaml: - APPL-11-000001 ``` I suspect there may be additional conflicts (in labeling and/or tagging) with the STIG rules for touchid and apple watch, but haven't checked carefully.

michael closed this issue

2026-01-19 18:29:54 +00:00

michael commented

2026-01-19 18:29:55 +00:00

@golbiga commented on GitHub:

Yep, we have some cleanup to do for STIG references.

@golbiga commented on GitHub: Yep, we have some cleanup to do for `STIG` references.

michael commented

2026-01-19 18:29:55 +00:00

@golbiga commented on GitHub:

@bernstei sysprefs_touchid_unlock_disable.yaml actually doesn't fall under the STIG and will be N/A. We're planning to make some updates to the STIG baselines soon.

@golbiga commented on GitHub: @bernstei `sysprefs_touchid_unlock_disable.yaml` actually doesn't fall under the STIG and will be `N/A`. We're planning to make some updates to the STIG baselines soon.

michael commented

2026-01-19 18:29:55 +00:00

@bernstei commented on GitHub:

Thanks. Perhaps that's also the response to #88

@bernstei commented on GitHub: Thanks. Perhaps that's also the response to #88

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#277