usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Output of check using jq for two DDM rules fail to match #34

New Issue
Closed
opened 2026-01-19 18:29:00 +00:00 by michael · 1 comment
michael commented 2026-01-19 18:29:00 +00:00
Owner
Copy Link

Originally created by @jordywitteman on GitHub.

Summary

When parsing DiskManagement_Settings.plist via plutil and jq, the .ExternalStorage restriction outputs "ReadOnly" (with quotes) instead of ReadOnly. This seems to apply for both the os_external_storage_access_defined and os_network_storage_restriction rules which both use jq

Steps to reproduce

  1. Apply a DDM Disk Management Configuration, for example with the ReadOnly value
  2. Run the following command: /usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq '.Restrictions | .ExternalStorage'
  3. Observe the output: "ReadOnly"
  4. Run an audit/remediation script
  5. Observe the log file at /Library/Logs/YOUR_BASELINE.log and search for os_external_storage_access_defined or os_network_storage_restriction
  6. The log outputs: os_external_storage_access_defined failed (Result: "ReadOnly", Expected: "{'string': 'ReadOnly'}")

Operating System version

macOS 15.6 (24G84)

Intel or Apple Silicon

Apple Silicon

What is the current bug behavior?

The rule check outputs the value with double quotes, such as "ReadOnly"

What is the expected correct behavior?

The rule check should out the value without double quotes, such as ReadOnly which matches the expected value in the rule file

Relevant logs and/or screenshots

Image Image

Output of checks

os_external_storage_access_defined failed (Result: "ReadOnly", Expected: "{'string': 'ReadOnly'}")

Possible fixes

Use the -r or --raw-output as an option of the jq command. For example: /usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage'

Originally created by @jordywitteman on GitHub. <!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "regression" or "bug" label and verify the issue you're about to submit isn't a duplicate. ---> ### Summary When parsing `DiskManagement_Settings.plist` via `plutil` and `jq`, the `.ExternalStorage` restriction outputs `"ReadOnly"` (with quotes) instead of `ReadOnly`. This seems to apply for both the `os_external_storage_access_defined` and `os_network_storage_restriction` rules which both use `jq` ### Steps to reproduce 1. Apply a DDM Disk Management Configuration, for example with the `ReadOnly` value 2. Run the following command: `/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq '.Restrictions | .ExternalStorage'` 3. Observe the output: `"ReadOnly"` 4. Run an audit/remediation script 5. Observe the log file at `/Library/Logs/YOUR_BASELINE.log` and search for `os_external_storage_access_defined` or `os_network_storage_restriction` 6. The log outputs: `os_external_storage_access_defined failed (Result: "ReadOnly", Expected: "{'string': 'ReadOnly'}")` ### Operating System version macOS 15.6 (24G84) ### Intel or Apple Silicon Apple Silicon ### What is the current *bug* behavior? The rule check outputs the value with double quotes, such as `"ReadOnly"` ### What is the expected *correct* behavior? The rule check should out the value without double quotes, such as `ReadOnly` which matches the expected value in the rule file ### Relevant logs and/or screenshots <img width="830" height="287" alt="Image" src="https://github.com/user-attachments/assets/51b9e0e5-c8a3-4b68-815e-a7454181fa75" /> <img width="1624" height="831" alt="Image" src="https://github.com/user-attachments/assets/d49e5cf1-4d3e-4136-a3fb-ab28ee262f54" /> ### Output of checks `os_external_storage_access_defined failed (Result: "ReadOnly", Expected: "{'string': 'ReadOnly'}")` ### Possible fixes Use the `-r` or `--raw-output` as an option of the `jq` command. For example: `/usr/bin/plutil -convert json /var/db/ManagedConfigurationFiles/DiskManagement/DiskManagement_Settings.plist -o - | /usr/bin/jq --raw-output '.Restrictions.ExternalStorage'`
michael commented 2026-01-19 18:29:00 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Thanks for bringing this to our attention.

@robertgendler commented on GitHub: Thanks for bringing this to our attention.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#34
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?