usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 05:53:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

manual tag not removable by rule customization #7

New Issue
Open
opened 2026-01-19 18:28:55 +00:00 by michael · 3 comments
michael commented 2026-01-19 18:28:55 +00:00
Owner
Copy Link

Originally created by @infinitesteps on GitHub.

Summary

When adding a rule customization in custom/rules/ that removes the 'manual' tag from the tags element, the guidance and audit scripts do not honor the removal of the manual tag.

Steps to reproduce

  1. Add custom/rules/system_settings_wifi_disable.yaml (note absence of 'manual' tag)

    ---
tags:
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cnssi-1253_moderate

  2. Generate guidance for baseline that uses system_settings_wifi_disable

    • Note log message: "Custom settings found for rule: ../custom/rules/system_settings_wifi_disable.yaml"

  3. View documentation PDF/HTML and note that the following still shows for system_settings_wifi_disable

    • "This rule is marked as manual and may not be able to be automated. It is also excluded in the compliance scan and will not report any results."

  4. Also a compliance check will not use rule system_settings_wifi_disable

Operating System version

Sequoia 15.7.1 (24G231)

Intel or Apple Silicon

Intel

What is the current bug behavior?

rule skipped

What is the expected correct behavior?

rule used for compliance check

Relevant logs and/or screenshots

NA

Output of checks

NA

Possible fixes

NA

Originally created by @infinitesteps on GitHub. ### Summary When adding a rule customization in custom/rules/ that removes the 'manual' tag from the tags element, the guidance and audit scripts do not honor the removal of the manual tag. ### Steps to reproduce 1. Add custom/rules/system_settings_wifi_disable.yaml (note absence of 'manual' tag) ```yaml --- tags: - 800-53r4_low - 800-53r4_moderate - 800-53r4_high - 800-53r5_low - 800-53r5_moderate - 800-53r5_high - cisv8 - cnssi-1253_low - cnssi-1253_high - cmmc_lvl2 - cnssi-1253_moderate ``` 2. Generate guidance for baseline that uses system_settings_wifi_disable - Note log message: "Custom settings found for rule: ../custom/rules/system_settings_wifi_disable.yaml" 3. View documentation PDF/HTML and note that the following still shows for system_settings_wifi_disable - "This rule is marked as manual and may not be able to be automated. It is also excluded in the compliance scan and will not report any results." 4. Also a compliance check will not use rule system_settings_wifi_disable ### Operating System version Sequoia 15.7.1 (24G231) ### Intel or Apple Silicon Intel ### What is the current *bug* behavior? rule skipped ### What is the expected *correct* behavior? rule used for compliance check ### Relevant logs and/or screenshots NA ### Output of checks NA ### Possible fixes NA
michael commented 2026-01-19 18:28:55 +00:00
Author
Owner
Copy Link

@brodjieski commented on GitHub:

The mechanism that handles customized tags currently only allows for appending or adding new tags, it will not remove tags from an established rule.

The rules that have the manual tag typically do not have any automated check and/or fix content, and therefore cannot be done in an automated fashion. If you do have a means to automate one of the manual checks, then we should consider updating any of those rule files accordingly. Please let us know if you have any suggested updates to specific rule files.

I'm not sure we will implement a means of removing tags via customization, so if you need this, I would suggest removing the manual tag directly from the rule files that you would like to have automated.

@brodjieski commented on GitHub: The mechanism that handles customized tags currently only allows for appending or adding new tags, it will not remove tags from an established rule. The rules that have the manual tag typically do not have any automated check and/or fix content, and therefore cannot be done in an automated fashion. If you do have a means to automate one of the manual checks, then we should consider updating any of those rule files accordingly. Please let us know if you have any suggested updates to specific rule files. I'm not sure we will implement a means of removing tags via customization, so if you need this, I would suggest removing the manual tag directly from the rule files that you would like to have automated.
michael commented 2026-01-19 18:28:55 +00:00
Author
Owner
Copy Link

@brodjieski commented on GitHub:

Thank you for the feedback. The manual rules, are by nature, not something the compliance scan is able to evaluate automatically. In the case of system_settings_wifi_disable, there isn't a means to know which wifi networks are authorized, so in order to prevent systems from disabling wifi automatically and potentially disconnecting systems from a means to connect to their MDM, it was decided that this rule should have some sort of manual processing.

Tags are a set of metadata keywords associated with rule files and removing by means of customization isn't something we are going to implement.

Rather, if you want to have a fully customized rule that has the tags you desire, you can duplicate the rule file as a new customized rule and use that in your baseline. Just give it a unique filename and matching ID, remove the manual tag (or any other tags you don't need) and include that in your custom folder. This should add the rule to your setup and can be deployed as usual.

You mentioned that you are going to have them set to exempt anyway... so why not just exclude them altogether? You probably need to document the exemption, so why not just document the exclusion?

@brodjieski commented on GitHub: Thank you for the feedback. The manual rules, are by nature, not something the compliance scan is able to evaluate automatically. In the case of system_settings_wifi_disable, there isn't a means to know which wifi networks are authorized, so in order to prevent systems from disabling wifi automatically and potentially disconnecting systems from a means to connect to their MDM, it was decided that this rule should have some sort of manual processing. Tags are a set of metadata keywords associated with rule files and removing by means of customization isn't something we are going to implement. Rather, if you want to have a fully customized rule that has the tags you desire, you can duplicate the rule file as a new customized rule and use that in your baseline. Just give it a unique filename and matching ID, remove the manual tag (or any other tags you don't need) and include that in your custom folder. This should add the rule to your setup and can be deployed as usual. You mentioned that you are going to have them set to exempt anyway... so why not just exclude them altogether? You probably need to document the exemption, so why not just document the exclusion?
michael commented 2026-01-19 18:28:55 +00:00
Author
Owner
Copy Link

@infinitesteps commented on GitHub:

It is frustrating that manual rules are not included in the compliance scan/report.

The system_settings_wifi_disable has a working check and fix command.

I recommend allowing people to remove tags via customization. For the CMMC 2.0 sequoia rules I have two that are set to manual. I would like to remove the manual tag and then have them both set to exempt. Then they will show in the compliance report.

@infinitesteps commented on GitHub: It is frustrating that manual rules are not included in the compliance scan/report. The system_settings_wifi_disable has a working check and fix command. I recommend allowing people to remove tags via customization. For the CMMC 2.0 sequoia rules I have two that are set to manual. I would like to remove the manual tag and then have them both set to exempt. Then they will show in the compliance report.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#7
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?