usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

custom rule that sets mobileconfig: false still ends up creating a .mobileprofile file #279

New Issue
Closed
opened 2026-01-19 18:29:54 +00:00 by michael · 4 comments
michael commented 2026-01-19 18:29:54 +00:00
Owner
Copy Link

Originally created by @bernstei on GitHub.

Summary

The logic that searches for default and custom rules when generating .mobileconfig files in generate_profiles finds both, because of these lines

            for rule in glob.glob('../rules/*/{}.yaml'.format(profile_rule)) + glob.glob('../custom/rules/**/{}.yaml'.format(profile_rule),recursive=True):
                rule_yaml = get_rule_yaml(rule, False)

As a result, even if a custom rule is created with mobileconfig: false, a mobileconfig file is still created in build/baseline_name/mobileconfigs/unsigned, even though setting a custom rule would make me expect that it would not. As a result, it's not correct to install all the created mobileconfig files in the build subdirectory.

Steps to reproduce

Define a custom rule that has mobileconfig: false instead of true and generate guidance with -p to generate profiles.

Operating System version

OS X 11.5.1

What is the current bug behavior?

A mobileconfig payload is created

What is the expected correct behavior?

no mobileconfig payload is created

Possible fixes

Make the custom rule override, rather than just be parsed along with, the default rule, similar to the logic used in generate_scripts or main (e.g. around line 1590), which overrides the default rule with any custom rule that is found.

Originally created by @bernstei on GitHub. ### Summary The logic that searches for default and custom rules when generating .mobileconfig files in `generate_profiles` finds *both*, because of these lines ``` for rule in glob.glob('../rules/*/{}.yaml'.format(profile_rule)) + glob.glob('../custom/rules/**/{}.yaml'.format(profile_rule),recursive=True): rule_yaml = get_rule_yaml(rule, False) ``` As a result, even if a custom rule is created with `mobileconfig: false`, a mobileconfig file is still created in `build/baseline_name/mobileconfigs/unsigned`, even though setting a custom rule would make me expect that it would not. As a result, it's not correct to install all the created mobileconfig files in the build subdirectory. ### Steps to reproduce Define a custom rule that has `mobileconfig: false` instead of true and generate guidance with `-p` to generate profiles. ### Operating System version OS X 11.5.1 ### What is the current *bug* behavior? A mobileconfig payload is created ### What is the expected *correct* behavior? no mobileconfig payload is created ### Possible fixes Make the custom rule _override_, rather than just be parsed along with, the default rule, similar to the logic used in `generate_scripts` or `main` (e.g. around line 1590), which *overrides* the default rule with any custom rule that is found.
michael commented 2026-01-19 18:29:55 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Fixed with commit dff6c6f2ef in Big_Sur, Catalina, and Monterey

@robertgendler commented on GitHub: Fixed with commit https://github.com/usnistgov/macos_security/commit/dff6c6f2efeedef8c6f91ca8467dc285ad3b2e9c in Big_Sur, Catalina, and Monterey
michael commented 2026-01-19 18:29:55 +00:00
Author
Owner
Copy Link

@bernstei commented on GitHub:

Thanks for the clarification. I appreciate all the work you've been doing.

@bernstei commented on GitHub: Thanks for the clarification. I appreciate all the work you've been doing.
michael commented 2026-01-19 18:29:55 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

@bernstei
Copied the wrong commit. This is the right commit 0f84f7029e

@robertgendler commented on GitHub: @bernstei Copied the wrong commit. This is the right commit 0f84f7029efd74ed627c158b050b50e76c499cde
michael commented 2026-01-19 18:29:55 +00:00
Author
Owner
Copy Link

@bernstei commented on GitHub:

@robertgendler Can you please explain how this commit fixes the issue? The commit (dff6c6f) seems to only modify the logic for creating PDF files, not mobileconfig payloads.

@bernstei commented on GitHub: @robertgendler Can you please explain how this commit fixes the issue? The commit (dff6c6f) seems to only modify the logic for creating PDF files, not mobileconfig payloads.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#279
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?