Prevent fixes when not needed #280

New Issue

michael · 2026-01-19T18:29:55Z

michael commented

2026-01-19 18:29:55 +00:00

Originally created by @robertgendler on GitHub.

In rules that edit text files, adding

/usr/bin/grep -qE "(regular expression from the check) file/to/change || (current fix)

It will prevent the fix from occurring if not needed

for audit_flags_ad_configure for example
/usr/bin/grep -qE "^flags.*[^-]ad" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,ad/' /etc/security/audit_control; /usr/sbin/audit -s

Originally created by @robertgendler on GitHub. In rules that edit text files, adding `/usr/bin/grep -qE "(regular expression from the check) file/to/change || (current fix)` It will prevent the fix from occurring if not needed for audit_flags_ad_configure for example `/usr/bin/grep -qE "^flags.*[^-]ad" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,ad/' /etc/security/audit_control; /usr/sbin/audit -s`

michael closed this issue

2026-01-19 18:29:55 +00:00

michael commented

2026-01-19 18:29:55 +00:00

@golbiga commented on GitHub:

This has been addressed in main, big_sur, and catalina.

@golbiga commented on GitHub: This has been addressed in `main`, `big_sur`, and `catalina`.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#280