Re: Upgrade Kext from 10.5 to 10.6 - mac_vnop and KUNC
Re: Upgrade Kext from 10.5 to 10.6 - mac_vnop and KUNC
- Subject: Re: Upgrade Kext from 10.5 to 10.6 - mac_vnop and KUNC
- From: Terry Lambert <email@hidden>
- Date: Wed, 3 Mar 2010 13:48:31 -0800
On Mar 3, 2010, at 12:32 PM, Chris Gates wrote:
I am trying to get a Kext that I had working on 10.5 to work on 10.6.
It's a research system to detect flow from processes to files in the
system using KAUTH to detect events, extended attribtutes to mark
files, and KUNC to notify the users on certain events (sometimes
preventing execution before it occurs). It works on 10.5.8 how I want
it to, never crashes, etc.
When trying to move it onto 10.6 it is failing to load and I am
getting these errors when I run "kextibs -all-symbols" on it -
3 symbols not found in any library
_KUNCUserNotificationDisplayAlert
_mac_vnop_getxattr
_mac_vnop_setxattr
I know that none of these things are actually supported, but since
this is just for limited use, is there any way around this problem?
There are no errors when building.
I imagine that you were previously linking your KEXT vs. the entire
kernel to get at all the kernel symbols, which is no longer
supported. My guess is that you are now working with a 64 bit kernel?
KUNCUserNotificationDisplayAlert is exported by System6.0.exports and
Unsupported.exports
You can get to this by declaring appropriate dependencies for your
KEXT (OSBundleLibraries / com.apple.kpi.unsupported - String -
10,0,0d2). Note that "Unsupported" is code for "this is going away in
a future release, so please stop using this API and build your own
user agent daemon to talk to your driver instead".
mac_vnop_getxattr and mac_vnop_setxattr are exported by
MACFramework.exports
You will not be able to get to this; the MACF KPI is private and
currently unpublished, and subject to change or removal in future
releases.
Your best bet is to build your own kernel, including your code in the
kernel proper so that it can access private symbols like this.
-- Terry
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden