Compliance Count CIS lvl2 #60

New Issue

michael · 2026-01-19T18:29:05Z

michael commented

2026-01-19 18:29:05 +00:00

Originally created by @anthonydarte on GitHub.

Summary

The result of the exemption count is incorrect compared to the actual count in the org.cis_lvl2.audit.plist file.

CIS Lvl 2

Steps to reproduce

You only need to add exemptions for rules starting with 'OS' in the org.cis_lvl2.audit.plist file:
os_nfsd_disable,
os_password_hint_remove,
os_policy_banner_loginwindow_enforce,

while the rules with 'pw' are fine:
pwpolicy_account_lockout_enforce,
pwpolicy_account_lockout_timeout_enforce,
pwpolicy_alpha_numeric_enforce,
pwpolicy_custom_regex_enforce,
pwpolicy_history_enforce,
pwpolicy_max_lifetime_enforce,
pwpolicy_minimum_length_enforce,
pwpolicy_special_character_enforce.

Operating System version

MacOS 15.3

Intel or Apple Silicon

Apple Silicon Mac

What is the current bug behavior?

With --stats, there are only 8.

What is the expected correct behavior?

The total number of exemptions should be 11

Relevant logs and/or screenshots

Output of checks

Possible fixes

# Generate the Compliant and Non-Compliant counts. Returns: Array (Compliant, Non-Compliant)
compliance_count(){
    compliant=0
    non_compliant=0
    exempt_count=0
    
    rule_names=($(/usr/libexec/PlistBuddy -c "Print" $audit_plist | awk '/= Dict/ {print $1}'))
    
    for rule in ${rule_names[@]}; do
        finding=$(/usr/libexec/PlistBuddy -c "Print $rule:finding" $audit_plist)
        if [[ $finding == "false" ]];then
            compliant=$((compliant+1))
        elif [[ $finding == "true" ]];then
            is_exempt=$(/usr/bin/osascript -l JavaScript << EOS 2>/dev/null
ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('org.cis_lvl2.audit').objectForKey("$rule"))["exempt"]
EOS
)
            if [[ $is_exempt == "1" ]]; then
                exempt_count=$((exempt_count+1))
                non_compliant=$((non_compliant+1))
            else    
                non_compliant=$((non_compliant+1))
            fi
        fi
    done

    # Enable output of just the compliant or non-compliant numbers.
    if [[ $1 = "compliant" ]]
    then
        echo $compliant
    elif [[ $1 = "non-compliant" ]]
    then
        echo $non_compliant
    else # no matching args output the array
        array=($compliant $non_compliant $exempt_count)
        echo ${array[@]}
    fi
}

For me, the problem seems to come from this function.
I have the impression that it comes from the osascript.

Originally created by @anthonydarte on GitHub. ### Summary The result of the exemption count is incorrect compared to the actual count in the org.cis_lvl2.audit.plist file. CIS Lvl 2 ### Steps to reproduce You only need to add exemptions for rules starting with 'OS' in the org.cis_lvl2.audit.plist file: os_nfsd_disable, os_password_hint_remove, os_policy_banner_loginwindow_enforce, while the rules with 'pw' are fine: pwpolicy_account_lockout_enforce, pwpolicy_account_lockout_timeout_enforce, pwpolicy_alpha_numeric_enforce, pwpolicy_custom_regex_enforce, pwpolicy_history_enforce, pwpolicy_max_lifetime_enforce, pwpolicy_minimum_length_enforce, pwpolicy_special_character_enforce. ### Operating System version MacOS 15.3 ### Intel or Apple Silicon Apple Silicon Mac ### What is the current *bug* behavior? With --stats, there are only 8. ### What is the expected *correct* behavior? The total number of exemptions should be 11 ### Relevant logs and/or screenshots <img width="414" alt="Image" src="https://github.com/user-attachments/assets/82ad99bb-5452-4382-b9c1-bd3185af619f" /> <img width="378" alt="Image" src="https://github.com/user-attachments/assets/519893e1-7be2-4536-85ba-170920a780b8" /> ### Output of checks ### Possible fixes ``` # Generate the Compliant and Non-Compliant counts. Returns: Array (Compliant, Non-Compliant) compliance_count(){ compliant=0 non_compliant=0 exempt_count=0 rule_names=($(/usr/libexec/PlistBuddy -c "Print" $audit_plist | awk '/= Dict/ {print $1}')) for rule in ${rule_names[@]}; do finding=$(/usr/libexec/PlistBuddy -c "Print $rule:finding" $audit_plist) if [[ $finding == "false" ]];then compliant=$((compliant+1)) elif [[ $finding == "true" ]];then is_exempt=$(/usr/bin/osascript -l JavaScript << EOS 2>/dev/null ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('org.cis_lvl2.audit').objectForKey("$rule"))["exempt"] EOS ) if [[ $is_exempt == "1" ]]; then exempt_count=$((exempt_count+1)) non_compliant=$((non_compliant+1)) else non_compliant=$((non_compliant+1)) fi fi done # Enable output of just the compliant or non-compliant numbers. if [[ $1 = "compliant" ]] then echo $compliant elif [[ $1 = "non-compliant" ]] then echo $non_compliant else # no matching args output the array array=($compliant $non_compliant $exempt_count) echo ${array[@]} fi } ``` For me, the problem seems to come from this function. I have the impression that it comes from the osascript.

michael closed this issue

2026-01-19 18:29:05 +00:00

michael commented

2026-01-19 18:29:06 +00:00

@brodjieski commented on GitHub:

Hello!
If the system is passing those rules, they will not be reported as exempt, since they are naturally compliant. The exemption reports those items that fail, but get the OK since they are exempt from requiring the rule.

If you are still failing those checks, but they are not reporting as exempt, send along your .plist file and I'll see if I can troubleshoot further.

Thanks!

@brodjieski commented on GitHub: Hello! If the system is passing those rules, they will not be reported as exempt, since they are naturally compliant. The exemption reports those items that fail, but get the OK since they are exempt from requiring the rule. If you are still failing those checks, but they are not reporting as exempt, send along your .plist file and I'll see if I can troubleshoot further. Thanks!

michael commented

2026-01-19 18:29:06 +00:00

@anthonydarte commented on GitHub:

Indeed, the exempted rules are properly respected. I understand the error better now. Thank you.

@anthonydarte commented on GitHub: Indeed, the exempted rules are properly respected. I understand the error better now. Thank you.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#60