How to detect the correct OS version for MacOS?

[sschaenz]

Hi,

I noticed that my macOS version is not detected correctly by Mondoo. In GO there is no standard library that also outputs the OS version. Through the standard library, it is possible to find out which operating system is used, but not in which version. If it is known which OS is used (which Mondoo also does correctly for Mac), then you could get the info with the CLI command sw_vers -productVersion or with cat /System/Library/CoreServices/SystemVersion.plist. I would appreciate it if Mondoo could do that too. Or is there another way I missed getting Mondoo to output the correct version of the operating system?

mondoo scan local on my mac gives the result:

platform.title: "Mac OS X, bare metal"
platform.arch: "x86_64"
os.hostname: "xxxxx"
platform.release: "10.16"

(Mondoo 7.13.0)

The command sw_vers -productVersion gives me the right version:

$ sw_vers -productVersion
13.1

[chris-rock]

@sschaenz Thank you for the report. This issue seem to be related to macOS Ventura. On macOS Monterey the output is identical:

cnspec> platform { title arch release }
platform: {
  arch: "arm64"
  title: "macOS, bare metal"
  release: "12.6"
}
cnspec> 

sw_vers -productVersion
12.6

I quickly tested Ventura and can confirm this issue

[chris-rock]

We are still investigating why macOS enables the compatibility mode.

cnspec shell local
  ___ _ __  ___ _ __   ___  ___ 
 / __| '_ \/ __| '_ \ / _ \/ __|
| (__| | | \__ \ |_) |  __/ (__ 
 \___|_| |_|___/ .__/ \___|\___|
   mondoo™     |_|              
cnspec> platform { title release }
platform: {
  title: "Mac OS X, bare metal"
  release: "10.16"
}

But when the environment variable for macOS is explicitly set the output is correct:

SYSTEM_VERSION_COMPAT=0 cnspec shell local
  ___ _ __  ___ _ __   ___  ___ 
 / __| '_ \/ __| '_ \ / _ \/ __|
| (__| | | \__ \ |_) |  __/ (__ 
 \___|_| |_|___/ .__/ \___|\___|
   mondoo™     |_|              
cnspec> platform { title release }
platform: {
  title: "macOS, bare metal"
  release: "13.1"
}

Therefore the current mitigation is to run cnspec with SYSTEM_VERSION_COMPAT=0 environment variable.