usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

audit_events Sandbox violations #306

New Issue
Closed
opened 2026-01-19 18:30:00 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:30:00 +00:00
Owner
Copy Link

Originally created by @robertgendler on GitHub.

Audit is overly busy and talkative

Editing the audit_event file and changing
43127:AUE_MAC_SYSCALL:mac_syscall(2):ad
to
43127:AUE_MAC_SYSCALL:mac_syscall(2):zz
Will stop sandbox violations from being in the audit logs but make them still auditable if desired using the zz flag.

Possibly adding an audit supplemental or rule.

Originally created by @robertgendler on GitHub. Audit is overly busy and talkative Editing the audit_event file and changing `43127:AUE_MAC_SYSCALL:mac_syscall(2):ad` to `43127:AUE_MAC_SYSCALL:mac_syscall(2):zz` Will stop sandbox violations from being in the audit logs but make them still auditable if desired using the zz flag. Possibly adding an audit supplemental or rule.
michael commented 2026-01-19 18:30:00 +00:00
Author
Owner
Copy Link

@golbiga commented on GitHub:

merged with main

@golbiga commented on GitHub: merged with `main`
michael commented 2026-01-19 18:30:00 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Added a note in audit_flags_ad_configure with commit dc3e5e1e27

@robertgendler commented on GitHub: Added a note in audit_flags_ad_configure with commit dc3e5e1e278b95b5c6dc4cf2a69265f1af07ff6e
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#306
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?