Tailoring system_settings_screensaver_ask_for_password_delay_enforce $ODV=0 does not create a custom rule #3

New Issue

michael · 2026-01-19T18:28:53Z

michael commented

2026-01-19 18:28:53 +00:00

Originally created by @adammfurman on GitHub.

Summary

When tailoring a baseline, the rule system_settings_screensaver_ask_for_password_delay_enforce asks for an $ODV. Entering "0" as the $ODV does not result in creating a custom value in /custom/rules. Rather, it treats it as accepting the default recommended value of "5".

Steps to reproduce

On the tahoe branch:

Run the generate_baseline.py -k {baseline} -t script to tailor a chosen baseline.
When asked to include the rule system_settings_screensaver_ask_for_password_delay_enforce, enter "y"
When asked for an $ODV, enter "0"
Complete tailoring the baseline.
A custom rule for system_settings_screensaver_ask_for_password_delay_enforce is not found in custom/rules.

Operating System version

macOS 26.2 (25C56)

Intel or Apple Silicon

Apple Silicon Mac (M1 Max)

What is the current bug behavior?

A custom rule is not generated in custom/rules for system_settings_screensaver_ask_for_password_delay_enforce when tailoring the $ODV to "0".

What is the expected correct behavior?

A custom $ODV value for the system_settings_screensaver_ask_for_password_delay_enforce rule should be found in custom/rules

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

Originally created by @adammfurman on GitHub.  ### Summary When tailoring a baseline, the rule system_settings_screensaver_ask_for_password_delay_enforce asks for an $ODV. Entering "0" as the $ODV does not result in creating a custom value in /custom/rules. Rather, it treats it as accepting the default recommended value of "5". ### Steps to reproduce On the tahoe branch: 1. Run the generate_baseline.py -k {baseline} -t script to tailor a chosen baseline. 2. When asked to include the rule system_settings_screensaver_ask_for_password_delay_enforce, enter "y" 3. When asked for an $ODV, enter "0" 4. Complete tailoring the baseline. 5. A custom rule for system_settings_screensaver_ask_for_password_delay_enforce is not found in custom/rules. ### Operating System version macOS 26.2 (25C56) ### Intel or Apple Silicon Apple Silicon Mac (M1 Max) ### What is the current *bug* behavior? A custom rule is not generated in custom/rules for system_settings_screensaver_ask_for_password_delay_enforce when tailoring the $ODV to "0". ### What is the expected *correct* behavior? A custom $ODV value for the system_settings_screensaver_ask_for_password_delay_enforce rule should be found in custom/rules ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes (If you can, link to the line of code that might be responsible for the problem)

michael commented

2026-01-19 18:28:54 +00:00

@brodjieski commented on GitHub:

Identified the issue where when setting the value to 0, python treated it as false. This is corrected in the dev_2.0 branch, but not sure we will address in 1.0.

@brodjieski commented on GitHub: Identified the issue where when setting the value to 0, python treated it as false. This is corrected in the dev_2.0 branch, but not sure we will address in 1.0.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#3