mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
audit_flags_fm_configure fix script no longer working #9
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @rs1278 on GitHub.
Summary
fix script for audit_flags_fm_configure does not work in macOS 15 or macOS 26
Steps to reproduce
running
/usr/bin/grep -qE "^flags.*-fd" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-fd/' /etc/security/audit_control;/usr/sbin/audit -sdoes not add ,fd to the file
/etc/security/audit_controlOperating System version
macOS 15.7.3
macOS 26.2
Intel or Apple Silicon
Apple Silicon
What is the current bug behavior?
/usr/bin/grep -qE "^flags.*-fd" /etc/security/audit_controldoes not add ,fd to the file
/etc/security/audit_control, but still returns 0 making the||operator pass without trying the backup commandWhat is the expected correct behavior?
,fd should be added tr to the file
/etc/security/audit_controlRelevant logs and/or screenshots
n/a
Output of checks
audit_flags_fm_configure failed (Result: 0, Expected: "{'integer': 1}")
Running the command to configure the settings for: audit_flags_fm_configure ...
Trigger sent.
Possible fixes
use this command instead (omit the part before the ||)
/usr/bin/sed -i.bak '/^flags/ s/$/,-fd/' /etc/security/audit_control;/usr/sbin/audit -s@brodjieski commented on GitHub:
With any of the
auditrelated controls, they require that theauditddaemon be configured and enabled. Running the fix for any of the audit flag rules on a system that does not haveauditdrunning will result in both failed checks and the inability to run the remediation script.With
auditdconfigured and running as outlined inaudit_auditd_enabled, I am unable to recreate the issue, and the commands work as expected.Verify the content in the
/etc/security/audit_controlfile along with the following to see thatauditdis running as expected:@rs1278 commented on GitHub:
Thank you for confirming the integrity of this code!
Despite
auditdrunning properly, it seems that this issue did resolve its self in our environment after our remediation script ran the fix command two or three times.