os_airdrop_disable check and remediation are inconsistent #287

New Issue

michael · 2026-01-19T18:29:56Z

michael commented

2026-01-19 18:29:56 +00:00

Originally created by @noambernstein on GitHub.

Originally assigned to: @golbiga on GitHub.

Summary

The profile entries that os_airdrop_disable tests and sets are not consistent

Steps to reproduce

apply the mobileconfig from a baseline that requires os_airdrop_disable, and run the check

Operating System version

11.3.0

What is the current bug behavior?

The remediation action for os_airdrop_disable is to set a mobileconfig with "allowAirDrop: false". However, the test is for "DisableAirDrop = 1"

What is the expected correct behavior?

It appears that "allowAirDrop: false" does disable airdrop, I think the check needs to look for "allowAirDrop = 0"

Possible fixes

Change ebca093853/rules/os/os_airdrop_disable.yaml (L8) to look for "allowAirDrop = 0"

Originally created by @noambernstein on GitHub. Originally assigned to: @golbiga on GitHub. ### Summary The profile entries that os_airdrop_disable tests and sets are not consistent ### Steps to reproduce apply the mobileconfig from a baseline that requires os_airdrop_disable, and run the check ### Operating System version 11.3.0 ### What is the current *bug* behavior? The remediation action for os_airdrop_disable is to set a mobileconfig with "allowAirDrop: false". However, the test is for "DisableAirDrop = 1" ### What is the expected *correct* behavior? It appears that "allowAirDrop: false" does disable airdrop, I think the check needs to look for "allowAirDrop = 0" ### Possible fixes Change https://github.com/usnistgov/macos_security/blob/ebca0938531b2b3e077966c6f3c083636a91bc2b/rules/os/os_airdrop_disable.yaml#L8 to look for "allowAirDrop = 0"

michael closed this issue

2026-01-19 18:29:56 +00:00

michael commented

2026-01-19 18:29:57 +00:00

@bernstei commented on GitHub:

Thanks for fixing this in the big_sur branch. How hard would it be to (automatically?) include the issue title in the commit message, rather than just the number?

@bernstei commented on GitHub: Thanks for fixing this in the big_sur branch. How hard would it be to (automatically?) include the issue _title_ in the commit message, rather than just the number?

michael commented

2026-01-19 18:29:57 +00:00

@golbiga commented on GitHub:

It actually should be DisableAirDrop = 1

ebca093853/rules/os/os_airdrop_disable.yaml (L43-L46)

will be adjusted to:

mobileconfig: true
mobileconfig_info:
   com.apple.NetworkBrowser:
       DisableAirDrop: true

Thanks for bringing this up.

@golbiga commented on GitHub: It actually should be DisableAirDrop = 1 https://github.com/usnistgov/macos_security/blob/ebca0938531b2b3e077966c6f3c083636a91bc2b/rules/os/os_airdrop_disable.yaml#L43-L46 will be adjusted to: ``` mobileconfig: true mobileconfig_info: com.apple.NetworkBrowser: DisableAirDrop: true ``` Thanks for bringing this up.

michael commented

2026-01-19 18:29:57 +00:00

@golbiga commented on GitHub:

Actually after looking though docs, we have the correct settings for the mobileconfig_info. I'll adjust the check to check for allowAirDrop = 0

@golbiga commented on GitHub: Actually after looking though docs, we have the correct settings for the `mobileconfig_info`. I'll adjust the check to check for `allowAirDrop = 0`

michael commented

2026-01-19 18:29:57 +00:00

@golbiga commented on GitHub:

merged with main

@golbiga commented on GitHub: merged with `main`

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#287