IPv6 Audit always fails

[alvarnell]

Only bugs related to the latest macOS release, Catalina (10.15.x), will be fixed
mOSL is being rewritten in Swift and the Bash version will be deprecated
See: https://0xmachos.github.io/2019-09-21-The-Future-of-mOSL.

Output of ./Lockdown debug:

√ mOSL-3.1.0-beta.2 % ./Lockdown debug  
[⚠️ ] Unable to verify Lockdown signature as minisign is not installed
[🍺] brew install minisign

Debug information: 
      mOSL Version:   v3.1.0-beta.2
      System Version: macOS 10.15.2 (19C46a)
      Kernel Version: Darwin 19.2.0
      Is admin:       True
      Full Disk Access: True
      Virtual Machine: False
      Codesigned:      no minisgn
      SIP:             True
      T2:              False

Describe the bug
Sorry that I'm just getting around to documenting this, but I've had this issue for at least a couple of years through multiple macOS versions.

I had manually disabled IPv6 long before I started using mOSL using networksetup for all network services, but Audit always shows [❌] Disable IPv6, even after running a Fix.

To Reproduce

Steps to reproduce the behavior:

1. Execute ./Lockdown Audit
2. Observe [❌] Disable IPv6
3. Execute ./Lockdown Fix 10
4. Observe Results:
   [❌] Disable IPv6
5. Execute ./Lockdown Audit
6. Observe [❌] Disable IPv6

Expected behavior

A clear and concise description of what you expected to happen.
Observe [✅] Disable IPv6
Terminal Output

If applicable, copy and paste your terminal output to help explain your problem.
√ mOSL-3.1.0-beta.2 % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
Ethernet
iPad USB
Thunderbolt FireWire
Wi-Fi
iPhone USB
Thunderbolt Bridge
Thunderbolt Ethernet Slot 1
Thunderbolt Ethernet Slot 1
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Ethernet
DHCP Configuration
Client ID:
IPv6: Off
Ethernet Address: 78:7b:8a:db:a6:4c
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Thunderbolt\ FireWire
DHCP Configuration
Client ID:
IPv6: Off
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Thunderbolt\ Bridge
DHCP Configuration
Client ID:
IPv6: Off
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Thunderbolt\ Ethernet\ Slot\ 1
DHCP Configuration
Client ID:
IPv6: Off
Ethernet Address: (null)
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Thunderbolt\ Ethernet\ Slot\ \ 1
DHCP Configuration
Client ID:
IPv6: Off
Ethernet Address: 64:4b:f0:12:b9:c0
√ mOSL-3.1.0-beta.2 % networksetup -getinfo Wi-Fi
Manually Using DHCP Router Configuration
IP address: 10.0.1.157
Subnet mask: 255.255.255.0
Router: 10.0.1.1
IPv6: Off
Wi-Fi ID: 14:20:5e:04:8c:90
Additional context

Add any other context about the problem here.

[0xmachos]

Thanks for reporting! I'm also aware of this bug thanks to @chall68. I wasn't sure if it was isolated to just him.

I'll take a look at some point this week.

Are you using zsh as your shell?

[alvarnell]

On Nov 25, 2019, at 12:29, Mikey ***@***.***> wrote: Thanks for reporting! I'm also aware of this bug thanks to @chall68 <https://github.com/chall68>. I wasn't sure if it was isolated to just him. I'll take a look at some point this week. Are you using zsh as your shell?

Yes, I switched over around June, but the results were exactly the same using bash prior to that.

…

-Al-

[0xmachos]

I can't reproduce this on my machine.

I suspect the issue is something to do with parsing the network service names.

My machine only has:

Wi-Fi
Bluetooth PAN
Thunderbolt Bridge

With set -x they appear as below when expanded:

+ networksetup -getinfo Wi-Fi
+ networksetup -getinfo 'Bluetooth PAN'
+ networksetup -getinfo 'Thunderbolt Bridge'

---

@alvarnell I noticed that you have two "Thunderbolt Ethernet Slot" services. The second one appears to have a double space in it Thunderbolt\ Ethernet\ Slot\ \ 1. I think that might something to do with it.

Would you mind modifying you local version of Lockdown to print a trace of commands being run by disable_ipv6 so we can see the values of arguments after they are expanded and before they are executed?

I would need you to make the following alterations:

• Add set -x to line 547
• Add set +x under line 560 creating line 561
• Comment out line 773

Here's patch you can apply to your version of Lockdown which will make the changes for you.

• 0001-disable_ipv6-Enable-ipv6-debug.-Disable-sig-check.patch

Assuming you're in the same directory as Lockdown, executing the following will apply the patch.

patch Lockdown 0001-disable_ipv6-Enable-ipv6-debug.-Disable-sig-check.patch

Once those changes have been made can you reply with the output of ./Lockdown audit please?

[0xmachos]

Here's the patch in a gist if anyone else is experiencing this bug and wants to help debug it

[alvarnell]

Sorry, I know I replied to this last week, but it seems to have vanished.

My time is limited right now and I'm spending it in Mojave, so don't know when I'll get a chance to get back to some version of Catalina, but I went ahead and applied the same patches to v2.4, ran it and got the following results:

√ mOSL-2.4.0 % ./Lockdown audit
[⚠️ ] Password required to run some commands with 'sudo': 

Results: 
  [❌] Enable Automatic System Updates
  [❌] Enable Automatic App Store Updates
  [✅] Enable Gatekeeper
  [✅] Enable Firewall
  [✅] Require an administrator password to access system-wide preferences
  [✅] Enable Terminal.app secure keyboard entry
  [✅] Enable System Integrity Protection (SIP)
  [✅] Enable FileVault
  [❌] Disable built-in software from being auto-permitted to listen through firewall
  [❌] Disable downloaded signed software from being auto-permitted to listen through firewall
+ local mode=audit
+ local title
+ local audit_command
+ local fix_command
+ title='Disable IPv6'
+ audit_command='while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))'
+ fix_command='while read -r i; do networksetup -setv6off "${i}"; done <<< "$(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))"'
+ mode_check audit 'Disable IPv6' 'while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))' 'while read -r i; do networksetup -setv6off "${i}"; done <<< "$(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))"'
+ local mode=audit
+ local 'title=Disable IPv6'
+ local 'audit_command=while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))'
+ local 'fix_command=while read -r i; do networksetup -setv6off "${i}"; done <<< "$(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))"'
+ [[ audit == \a\u\d\i\t ]]
+ audit 'Disable IPv6' 'while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))'
+ local 'title=Disable IPv6'
+ local 'command=while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))'
+ bash -c 'while IFS= read -r i; do if networksetup -getinfo "${i}" | grep -q "IPv6: Off"; then :; else exit 1; fi; done <<< $(networksetup -listallnetworkservices | tail -n $(( $(networksetup -listallnetworkservices | wc -l) - 1 )))'
+ echo '  [❌] Disable IPv6'
  [❌] Disable IPv6
+ return 1
+ set +x
  [✅] Disable automatic loading of remote content by Mail.app
  [✅] Disable Remote Apple Events
  [✅] Disable Remote Login
  [✅] Disable Safari Auto Open 'safe' Files
  [✅] Set AirDrop Discoverability to 'Contacts Only'
  [✅] Set AppStore update check to every one (1) day
  [❌] Set a firmware password
  [✅] Check Kernel Extension User Consent required
  [✅] Check EFI Firmware Integrity
  [❌] avarnell should not be an administrator

  [❌] 6/21 settings failed 😢