Relates to #35120
## Summary
Eleven policy queries in the macOS 26 CIS v1.0.0 benchmark fail or
produce incorrect results due to macOS 26 architecture changes. All
fixes are confined to `ee/cis/macos-26/cis-policy-queries.yml`.
| CIS ID | Policy | Root Cause | Change |
|---|---|---|---|
| 2.3.3.1 | Screen Sharing Is Disabled | macOS 26 socket activation:
`com.apple.screensharing` appears in `launchd` table when sharing is
**off**, not on — logic inverted | Replace `launchd WHERE label =
'com.apple.screensharing'` with `listening_ports WHERE port = 5900` |
| 2.3.3.2 | File Sharing Is Disabled | Same socket activation inversion
— `com.apple.smbd` entry behavior reversed | Replace `launchd WHERE
label = 'com.apple.smbd'` with `listening_ports WHERE port = 445` |
| 2.3.3.4 | Remote Login Is Disabled | Same socket activation inversion
— `com.openssh.sshd` entry behavior reversed | Replace `launchd WHERE
label = 'com.openssh.sshd'` with `listening_ports WHERE port = 22` |
| 2.3.3.6 | Remote Apple Events Is Disabled | Same socket activation
inversion — `com.apple.AEServer` entry behavior reversed | Replace
`launchd WHERE label = 'com.apple.AEServer'` with `listening_ports WHERE
port = 3031` |
| 2.3.3.7 | Internet Sharing Is Disabled | `com.apple.nat` plist nests
`Enabled` inside a `NAT` dictionary; `key = 'Enabled'` never matches at
the top level on macOS 26 | Replace `plist` check with
`sharing_preferences WHERE internet_sharing = 1` |
| 2.3.3.10 | Bluetooth Sharing Is Disabled | `com.apple.Bluetooth` plist
does not exist on macOS 26; `preferences` table returns no rows
regardless of sharing state | Replace `preferences` check with
`sharing_preferences WHERE bluetooth_sharing = 1` |
| 2.3.4.2 | Time Machine Volumes Are Encrypted | Previous query checked
`value = 'NotEncrypted'` in the `plist` table which never matches on
macOS 26; macOS 26 changed the `AutoBackup` boolean from `'1'` to
`'true'` | Rewrite to check `preferences WHERE key = 'AutoBackup' AND
value = 'true'` (TM enabled), pass if TM disabled or if an encrypted
volume is mounted |
| 5.2.2 | Password Minimum Length | macOS 26 `pwpolicy` creates
identifier `com.apple.policy.legacy.minChars`; query filters on
`%minLength` which never matches | Rewrite to use
`JSON_EXTRACT(policy_parameters, '$.minimumLength')` with
`policy_identifier LIKE '%minChars'` |
| 5.7 | Admin Cannot Unlock Locked Session | `LIKE
'%authenticate-session-owner%'` matches both
`authenticate-session-owner` (secure) and
`authenticate-session-owner-or-admin` (insecure) — query can never fail
| Add `AND rule NOT LIKE '%authenticate-session-owner-or-admin%'` |
| 5.10 | XProtect Is Running and Updated | `launchd` table on macOS 26
reads plist files from disk, not live service state — both entries
always present regardless of whether XProtect is running | Replace
`launchd` COUNT check with `processes WHERE name IN ('xprotectd',
'XProtectPluginService')` |
| 5.11 | Logging Is Enabled for Sudo | `sudo_info` JSON stores boolean
flags as `null` (sudo -V prints key name with no value); query checks
for `'true'`/`'1'` which never matches | Use `json_type(...) IS NOT
NULL` to detect key presence vs absence |
## Test plan
- [ ] Verify 2.3.3.1: screen sharing OFF → no port 5900 → PASS; screen
sharing ON → port 5900 present → FAIL
- [ ] Verify 2.3.3.2: file sharing OFF → no port 445 → PASS; file
sharing ON → port 445 present → FAIL
- [ ] Verify 2.3.3.4: remote login OFF → no port 22 → PASS; remote login
ON → port 22 present → FAIL
- [ ] Verify 2.3.3.6: remote apple events OFF → no port 3031 → PASS;
events ON → port 3031 present → FAIL
- [ ] Verify 2.3.3.7: internet sharing OFF → PASS; internet sharing ON →
FAIL
- [ ] Verify 2.3.3.10: bluetooth sharing OFF → PASS; bluetooth sharing
ON → FAIL
- [ ] Verify 2.3.4.2: Time Machine disabled → PASS; Time Machine enabled
with unencrypted destination → FAIL; Time Machine enabled with encrypted
destination → PASS
- [ ] Verify 5.2.2: `pwpolicy -setglobalpolicy "minChars=15"` → query
returns row (PASS); `minChars=8` → no row (FAIL)
- [ ] Verify 5.7: `authorizationdb write system.login.screensaver
authenticate-session-owner` → PASS;
`authenticate-session-owner-or-admin` → FAIL
- [ ] Verify 5.10: both `xprotectd` and `XProtectPluginService` running
→ PASS; either absent → FAIL
- [ ] Verify 5.11: `Defaults log_allowed` in sudoers.d → PASS; removed →
FAIL
Queries manually verified against macOS 26.5.1 VM and physical MacBook
Pro via fleetctl live queries — see issue #35120 for full QA notes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated several macOS CIS compliance checks to use more reliable
evidence, improving accuracy for network sharing, remote access, Time
Machine encryption, password policy length, sudo logging, session
security, and XProtect status.
* Tightened session-access validation so administrator login rules are
enforced more consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Marcus Allen <marcus@Marcuss-Work-MacBook-Pro.local>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
