Re: _validateBundleSecurity, _NSIsInsecureBundle, and dirIsRootUnsafe
Re: _validateBundleSecurity, _NSIsInsecureBundle, and dirIsRootUnsafe
- Subject: Re: _validateBundleSecurity, _NSIsInsecureBundle, and dirIsRootUnsafe
- From: John Stiles <email@hidden>
- Date: Sat, 25 Sep 2004 07:51:41 -0700
Are they running any hacks that try to inject code into applications
via the Input Manager?
This is a common method for "haxie" type applications nowadays.
On Sep 25, 2004, at 12:46 AM, Jean-Matthieu Schaffhauser wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear all,
I am using the Authorization features of Apple's Security framework to
launch my tool with root privileges. This part works fine. For
reference, I modified AuthForAllImpl.{c,h} from Apple example and
added the function : extern OSStatus ExecuteWithPrivileges(const char
* path), where path is the path of the binary to execute as root.
<!-- Code -->
extern OSStatus ExecuteWithPrivileges(const char * path)
// This routine executes a binary with privileges
{
OSStatus err;
char *args[] = {"rootsession", NULL};
static const AuthorizationFlags kFlags =
kAuthorizationFlagDefaults;
err = AuthorizationExecuteWithPrivileges(gAuthorization, path,
kFlags, args, NULL);
// Free the authorization reference.
AuthorizationFree(gAuthorization,kAuthorizationFlagDestroyRights);
return err;
}
<!-- End -->
When a user launches the application, the login/password window
appears correctly. When authenticated, the application launches itself
with privileges and the following crash may occur (but not on all
system. Some users with 10.3.5 got it running and some don't, using
the same release version) :
- --- CRASH LOG ---
Command: PureFTPd Manager
Path: /Applications/PureFTPd Manager.app/Contents/MacOS/PureFTPd
Manager
Version: PureFTPd Manager (1.3)
PID: 1741
Thread: 0
Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0005eadc
Thread 0 Crashed:
0 com.apple.AppKit 0x9317302c dirIsRootUnsafe + 0xa0
1 com.apple.AppKit 0x931730b8 dirIsRootUnsafe + 0x12c
2 com.apple.AppKit 0x931730b8 dirIsRootUnsafe + 0x12c
3 com.apple.AppKit 0x9317298c _NSIsInsecureBundle + 0x90
4 com.apple.AppKit 0x93085484 -[NSInputManager
_validateBundleSecurity] + 0x14
5 com.apple.AppKit 0x93084e94 -[NSInputManager _loadBundle]
+ 0x44
6 com.apple.AppKit 0x93086060 -[NSInputManager
initWithName:host:] + 0x548
7 com.apple.AppKit 0x92eb9234 +[NSInputManager initialize]
+ 0x398
8 libobjc.A.dylib 0x908329e0 class_initialize + 0x140
9 libobjc.A.dylib 0x90831524
_class_lookupMethodAndLoadCache + 0x84
10 libobjc.A.dylib 0x90831298 objc_msgSend + 0xb8
11 org.pureftpd.macosx 0x0001f638 -[UserController
disableUserFields] + 0x1cc (UserController.m:545)
12 org.pureftpd.macosx 0x0001df18 -[UserController
awakeFromNib] + 0x170 (UserController.m:128)
13 com.apple.Foundation 0x90a2e750 -[NSSet
makeObjectsPerformSelector:] + 0xa4
14 com.apple.AppKit 0x92df1c18 -[NSIBObjectData
nibInstantiateWithOwner:topLevelObjects:] + 0x358
15 com.apple.AppKit 0x92ee354c loadNib + 0xfc
16 com.apple.AppKit 0x92e3a798 +[NSBundle(NSNibLoading)
_loadNibFile:nameTable:withZone:ownerBundle:] + 0x2e8
17 com.apple.AppKit 0x92eb95c8 +[NSBundle(NSNibLoading)
loadNibFile:externalNameTable:withZone:] + 0x9c
18 com.apple.AppKit 0x92ecadbc +[NSBundle(NSNibLoading)
loadNibNamed:owner:] + 0x174
19 com.apple.AppKit 0x92eb9430 NSApplicationMain + 0x174
20 org.pureftpd.macosx 0x0000ad80 main + 0x5c (main.m:70)
21 org.pureftpd.macosx 0x0000a768 _start + 0x188 (crt.c:267)
22 dyld 0x8fe1a558 _dyld_start + 0x64
- --- END OF LOG ---
I can't find any documentation on _validateBundleSecurity,
_NSIsInsecureBundle, and dirIsRootUnsafe. Does anyone experienced this
problem and found a way to solve it ?
Kind regards,
Jean-Matthieu
- --
There's no place like ::1.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
iD8DBQFBVSJbKOvN2uszjgARAuBPAJ9Gm0oTcZo7c1JZ8FJYreN1FbwDIwCfXq+y
I5bN+mUcjiupCiOpGSw4FaU=
=q5nz
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Cocoa-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Cocoa-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden