Rules that use grep -c with the expected result of “1” should actually have the expected result of “greater than 0”

[erefneb]

Rules that use grep -c with the expected result of “1” should actually have the expected of “greater than 0”

There are instances where two rules test for the same key, just in different configuration profile domains.
For instance:
sysprefs_siri_prefpane_disable
/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'com.apple.preferences.speech'
mobileconfig_info:
com.apple.systempreferences:
DisabledPreferencePanes:
- com.apple.preferences.speech

sysprefs_siri_prefpane_hide
/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'com.apple.preferences.speech'
mobileconfig_info:
com.apple.systempreferences:
HiddenPreferencePanes:
- com.apple.preferences.speech

The above results with an integer of “2” and fails the test even though the configuration profile is correctly implemented.

[erefneb]

Or the expected result could be "not 0"
I'm trying to think of a good way to make this work within the current script.

[erefneb]

Just brainstormed with @golbiga.
The rule for sysprefs_screensaver_timeout_enforce.yaml has the answer.
This will not require changing the framework of the compliance script.

Add this to rules that are using /usr/bin/profiles -P -o stdout | /usr/bin/grep -c to find a config profile key and the expected result {'integer': 1}
| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'

For instance:
/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'com.apple.preferences.speech'
would become
/usr/bin/profiles -P -o stdout | /usr/bin/grep -c 'com.apple.preferences.speech' | /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'

If the result is 0 you fail. If the result is 1 or more you pass. So if you are enforcing a rule more than once you still pass, as you should.

[erefneb]

As far as I can tell...
| /usr/bin/awk '{ if ($1 >= 1) {print "1"} else {print "0"}}'
This should be added to rules yaml containing the following:
mobileconfig: true
check:
contains /usr/bin/grep -c
result:
integer: 1

By my count there are about 67 rules for config profiles that use grep -c and are expecting integer: 1

[robertgendler]

It's not a bad idea. We'll have to discuss and see. I worry if there may be a reason not to, that we're not thinking of. So I'm hesitant to go forth and update all of the rules.