usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-09 08:12:18 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Definition of exemption #297

New Issue
Closed
opened 2026-01-19 18:29:58 +00:00 by michael · 4 comments
michael commented 2026-01-19 18:29:58 +00:00
Owner
Copy Link

Originally created by @sebastianvoss on GitHub.

I followed the instruction outlined at https://github.com/usnistgov/macos_security/wiki/Compliance-Script:

sudo /usr/libexec/PlistBuddy -c "Delete os_firmware_password_require" /Library/Preferences/org.800-53_moderate.audit.plist
sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:exempt bool true" /Library/Preferences/org.800-53_moderate.audit.plist
sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:finding bool false" /Library/Preferences/org.800-53_moderate.audit.plist
sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:exempt_reason string 'Not supported for VM'" /Library/Preferences/org.800-53_moderate.audit.plist

But when I run sudo ./build/800-53_moderate/800-53_moderate_compliance.sh this rule is still failing:

ERROR | SetupTRBSettings | The firmware on this machine is not supported.
ERROR | main | Exiting with error: 5
Thu Mar 11 13:35:07 UTC 2021 os_firmware_password_require failed (Result: 0, Expected: {integer: 1})

How can I disable os_firmware_password_require?

Originally created by @sebastianvoss on GitHub. I followed the instruction outlined at https://github.com/usnistgov/macos_security/wiki/Compliance-Script: ``` sudo /usr/libexec/PlistBuddy -c "Delete os_firmware_password_require" /Library/Preferences/org.800-53_moderate.audit.plist sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:exempt bool true" /Library/Preferences/org.800-53_moderate.audit.plist sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:finding bool false" /Library/Preferences/org.800-53_moderate.audit.plist sudo /usr/libexec/PlistBuddy -c "Add :os_firmware_password_require:exempt_reason string 'Not supported for VM'" /Library/Preferences/org.800-53_moderate.audit.plist ``` But when I run `sudo ./build/800-53_moderate/800-53_moderate_compliance.sh` this rule is still failing: ``` ERROR | SetupTRBSettings | The firmware on this machine is not supported. ERROR | main | Exiting with error: 5 Thu Mar 11 13:35:07 UTC 2021 os_firmware_password_require failed (Result: 0, Expected: {integer: 1}) ``` How can I disable `os_firmware_password_require`?
michael commented 2026-01-19 18:29:58 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

@sebastianvoss which branch are you working off? The exemption feature has not made it to main yet. Depending on which OS you are looking to run on check either catalina or big_sur.

@golbiga commented on GitHub: @sebastianvoss which branch are you working off? The exemption feature has not made it to main yet. Depending on which OS you are looking to run on check either catalina or big_sur.
michael commented 2026-01-19 18:29:58 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

Yes, do a git checkout of big_sur and the exemption code will be in there. We're hoping to do a new revision for Catalina and Big Sur soon that will have that code in main. Let me know if that works.

@golbiga commented on GitHub: Yes, do a git checkout of big_sur and the exemption code will be in there. We're hoping to do a new revision for Catalina and Big Sur soon that will have that code in main. Let me know if that works.
michael commented 2026-01-19 18:29:58 +00:00
Author
Owner
Copy Link

@sebastianvoss commented on GitHub:

It works!

Thu Mar 11 14:33:54 UTC 2021 os_firmware_password_require has an exemption (Reason: Not needed for VM)

Thanks again for your help and this great project.

@sebastianvoss commented on GitHub: It works! ``` Thu Mar 11 14:33:54 UTC 2021 os_firmware_password_require has an exemption (Reason: Not needed for VM) ``` Thanks again for your help and this great project.
michael commented 2026-01-19 18:29:58 +00:00
Author
Owner
Copy Link

@sebastianvoss commented on GitHub:

Thanks for your fast reply!

I tried with main and also with big_sur_rev1 just now. But it shows the same behaviour. Do I need to use a different branch for MacOS Big Sur?

@sebastianvoss commented on GitHub: Thanks for your fast reply! I tried with `main` and also with `big_sur_rev1` just now. But it shows the same behaviour. Do I need to use a different branch for MacOS Big Sur?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#297
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?