Running compliance script generated by Jamf Compliance Editor in terminal and the GUI "Audit Run" results differ. (CISL1) #68

New Issue

michael · 2026-01-19T18:29:07Z

michael commented

2026-01-19 18:29:07 +00:00

Originally created by @ktdunn on GitHub.

Summary

If you run the compliance shell script in terminal the results will differ from the results of JCE "Audit Run". The terminal results will fewer tests passed and more failures.

Steps to reproduce

Generate guidance for CISL1
Run the compliance sh script in terminal
Run the Audit in the JCE GUI
Compare the results.

Operating System version

14.6.1 (23G93)

Intel or Apple Silicon

Apple Silicon

What is the current bug behavior?

The results of the sh script is fewer tests passed and more tests failed than the GUI results.

What is the expected correct behavior?

The results should match.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

(Paste any output that occurs with the bug)

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

org.audit.zip

Originally created by @ktdunn on GitHub. ### Summary If you run the compliance shell script in terminal the results will differ from the results of JCE "Audit Run". The terminal results will fewer tests passed and more failures. ### Steps to reproduce 1. Generate guidance for CISL1 2. Run the compliance sh script in terminal 3. Run the Audit in the JCE GUI 4. Compare the results. ### Operating System version 14.6.1 (23G93) ### Intel or Apple Silicon Apple Silicon ### What is the current *bug* behavior? The results of the sh script is fewer tests passed and more tests failed than the GUI results. ### What is the expected *correct* behavior? The results should match. ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks (Paste any output that occurs with the bug) ### Possible fixes (If you can, link to the line of code that might be responsible for the problem) ![image](https://github.com/user-attachments/assets/1a24cc19-30dd-448f-9f8f-80f8f464f401) [org.audit.zip](https://github.com/user-attachments/files/18117697/org.audit.zip)

michael closed this issue

2026-01-19 18:29:07 +00:00

michael commented

2026-01-19 18:29:07 +00:00

@anthonydarte commented on GitHub:

Hello,

I am experiencing the same issue with CIS Lvl2.

I believe I have found the problem by looking more closely at the script code. The native function correctly takes exemptions into account, whereas the --stats command does not.

    generate_report(){
    count=($(compliance_count))
    compliant=${count[1]}
    non_compliant=${count[2]}
    exempt_rules=${count[3]}

    total=$((non_compliant + compliant))
    percentage=$(printf %.2f $(( (compliant + exempt_rules) * 100. / total )) )
    echo
    echo "Number of tests passed: ${GREEN}$compliant${STD}"
    echo "Number of test FAILED: ${RED}$non_compliant${STD}"
    echo "Number of exempt rules: ${YELLOW}$exempt_rules${STD}"
    echo "You are ${YELLOW}$percentage%${STD} percent compliant!"
    pause
}

view_report(){

    if [[ $lastComplianceScan == "No scans have been run" ]];then
        echo "no report to run, please run new scan"
        pause
    else
        generate_report
    fi
}

vs

# Designed for use with MDM - single unformatted output of the Compliance Report
generate_stats(){
    count=($(compliance_count))
    compliant=${count[1]}
    non_compliant=${count[2]}

    total=$((non_compliant + compliant))
    percentage=$(printf %.2f $(( compliant * 100. / total )) )
    echo "PASSED: $compliant FAILED: $non_compliant, $percentage percent compliant!"
}

By modifying the function, it resolves the problem :

# Designed for use with MDM - single unformatted output of the Compliance Report
generate_stats(){
    count=($(compliance_count))
    compliant=${count[1]}
    non_compliant=${count[2]}
    exempt_rules=${count[3]}

    total=$((non_compliant + compliant))
    percentage=$(printf %.2f $(( (compliant + exempt_rules)  * 100. / total )) )
    echo "PASSED: $compliant FAILED: $non_compliant, EXEMPT: $exempt_rules, $percentage percent compliant!"
}

@anthonydarte commented on GitHub: Hello, I am experiencing the same issue with CIS Lvl2. I believe I have found the problem by looking more closely at the script code. The native function correctly takes exemptions into account, whereas the --stats command does not. ``` generate_report(){ count=($(compliance_count)) compliant=${count[1]} non_compliant=${count[2]} exempt_rules=${count[3]} total=$((non_compliant + compliant)) percentage=$(printf %.2f $(( (compliant + exempt_rules) * 100. / total )) ) echo echo "Number of tests passed: ${GREEN}$compliant${STD}" echo "Number of test FAILED: ${RED}$non_compliant${STD}" echo "Number of exempt rules: ${YELLOW}$exempt_rules${STD}" echo "You are ${YELLOW}$percentage%${STD} percent compliant!" pause } view_report(){ if [[ $lastComplianceScan == "No scans have been run" ]];then echo "no report to run, please run new scan" pause else generate_report fi } ``` vs ``` # Designed for use with MDM - single unformatted output of the Compliance Report generate_stats(){ count=($(compliance_count)) compliant=${count[1]} non_compliant=${count[2]} total=$((non_compliant + compliant)) percentage=$(printf %.2f $(( compliant * 100. / total )) ) echo "PASSED: $compliant FAILED: $non_compliant, $percentage percent compliant!" } ``` By modifying the function, it resolves the problem : ``` # Designed for use with MDM - single unformatted output of the Compliance Report generate_stats(){ count=($(compliance_count)) compliant=${count[1]} non_compliant=${count[2]} exempt_rules=${count[3]} total=$((non_compliant + compliant)) percentage=$(printf %.2f $(( (compliant + exempt_rules) * 100. / total )) ) echo "PASSED: $compliant FAILED: $non_compliant, EXEMPT: $exempt_rules, $percentage percent compliant!" } ```

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#68