os_anti_virus_installed errors: Tahoe

[nameitsa]

Summary

XProtect launch scans: disabled after running remediation steps,
checked #294 and ran the steps again after stopping xprotect via bootout and kill -9 pid of xprotect.

Steps to reproduce

Initial check showed:
XProtect launch scans: disabled
XProtect background scans: enabled

ran following commands
/bin/launchctl bootout system/com.apple.XprotectFramework.PluginService
/bin/launchctl bootout system/com.apple.XProtect.daemon.scan.startup
/bin/launchctl bootout system/com.apple.XProtect.daemon.scan

Then ran the remediation code:
/bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtect.daemon.scan.plist
/bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtectFramework.PluginService.plist

Final check before and after reboot showed:
XProtect launch scans: disabled
XProtect background scans: enabled

Also repeated above steps including:
/bin/launchctl load -w /Library/Apple/System/Library/LaunchDaemons/com.apple.XProtect.daemon.scan.startup.plist

Operating System version

Tahoe 26.1

Intel or Apple Silicon

Apple Silicon M5

What is the current bug behavior?

XProtect launch scans: disabled
XProtect background scans: enabled

What is the expected correct behavior?

XProtect launch scans: enabled
XProtect background scans: enabled

Relevant logs and/or screenshots

No Errors shown in terminal

Output of checks

XProtect launch scans: disabled
XProtect background scans: enabled

[robertgendler]

Did you disable SIP in order to be able to disable XProtect?

I have a root shell and am not able to do a bootout or a kill on the XProtect service.

/bin/launchctl bootout system/com.apple.XprotectFramework.PluginService
Boot-out failed: 150: Operation not permitted while System Integrity Protection is engaged
/bin/launchctl bootout system/com.apple.XProtect.daemon.scan.startup
Boot-out failed: 150: Operation not permitted while System Integrity Protection is engaged
/bin/launchctl bootout system/com.apple.XProtect.daemon.scan
Boot-out failed: 150: Operation not permitted while System Integrity Protection is engaged


ps aux | grep -i xprotect
rmg2              2161   0.0  0.0 435355968   9184   ??  S     3:50PM   0:04.99 /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/XPCServices/XProtectPluginService.xpc/Contents/MacOS/XProtectPluginService

kill -9 2161
kill: 2161: Operation not permitted

[nameitsa]

Hi @robertgendler, Yes I did disable SIP before doing the commands, the odd thing is on my 2019 intel macbook pro, this is showing up as enabled.

[brodjieski]

This rule is derived from the CIS benchmarks and uses the methodology as outlined by CIS. It appears that the commands do not work while SIP is disabled. We will have to engage with CIS to identify the correct course of action. If you are able, please open a ticket with them to add visibility to the issue.

Until then, I recommended not disabling SIP on your systems. Enabling SIP will restore the correct behavior and should report as compliant with the rule.

[nameitsa]

I tested to see if there were any changes with a reboot after sip was enabled before making this post, should have clarified that, though I will try to create a ticket with CIS.