MacOS 15 defintion for CCE-94310 "Configure Sudo To Log Events" calls the same testID twice #48

New Issue

michael · 2026-01-19T18:29:02Z

michael commented

2026-01-19 18:29:02 +00:00

Originally created by @vanderpol on GitHub.

Originally assigned to: @robertgendler on GitHub.

Summary

The definition calls the same test twice, which is odd. The fact that the test has an OR Criteria makes me believe that it should be pointing at a different test and is likely not fully accurate as-is. In searching for a test based on the criteria name, it appears that it likely should be calling test 5283 for the sudoers.d version of this test.

Sudo _MUST_ be configured to log privilege escalation.

Steps to reproduce

(How one can reproduce the issue - this is very important)

Operating System version

(macOS Version and build)

Intel or Apple Silicon

(Intel based process or Apple Silicon Mac)

What is the current bug behavior?

(What actually happens)

What is the expected correct behavior?

(What you should see instead)

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

Originally created by @vanderpol on GitHub. Originally assigned to: @robertgendler on GitHub. ### Summary The definition calls the same test twice, which is odd. The fact that the test has an OR Criteria makes me believe that it should be pointing at a different test and is likely not fully accurate as-is. In searching for a test based on the criteria name, it appears that it likely should be calling test 5283 for the sudoers.d version of this test. <definition id="oval:mscp:def:232" version="1" class="compliance"> <metadata> <title>Configure Sudo To Log Events</title> <reference source="CCE" ref_id="CCE-94310-0"/> <reference source="macos_security" ref_id="os_sudo_log_enforce_recommended"/> <description>Sudo _MUST_ be configured to log privilege escalation. </description> </metadata> <criteria operator="OR"> <criterion comment="os_sudo_log_enforce_recommended" test_ref="oval:mscp:tst:232"/> <criterion comment="os_sudo_log_enforce_recommended_sudoers.d" test_ref="oval:mscp:tst:232"/> </criteria> </definition> ### Steps to reproduce (How one can reproduce the issue - this is very important) ### Operating System version (macOS Version and build) ### Intel or Apple Silicon (Intel based process or Apple Silicon Mac) ### What is the current *bug* behavior? (What actually happens) ### What is the expected *correct* behavior? (What you should see instead) ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes (If you can, link to the line of code that might be responsible for the problem)

michael closed this issue

2026-01-19 18:29:02 +00:00

michael commented

2026-01-19 18:29:02 +00:00

@vanderpol commented on GitHub:

Correct, just noticed this error when re-processing the content to create a DISA STIG friendly benchmark. The error was found in the stig-oval file you created for us, but also exists in the released benchmark.

@vanderpol commented on GitHub: Correct, just noticed this error when re-processing the content to create a DISA STIG friendly benchmark. The error was found in the stig-oval file you created for us, but also exists in the released benchmark.

michael commented

2026-01-19 18:29:03 +00:00

@robertgendler commented on GitHub:

@vanderpol scap issue right?

@robertgendler commented on GitHub: @vanderpol scap issue right?

michael referenced this issue

2026-01-19 18:29:59 +00:00

Cleanup references #299

Sign in to join this conversation.