• Open Menu Close Menu
  • Apple
  • Shopping Bag
  • Apple
  • Mac
  • iPad
  • iPhone
  • Watch
  • TV
  • Music
  • Support
  • Search apple.com
  • Shopping Bag

Lists

Open Menu Close Menu
  • Terms and Conditions
  • Lists hosted on this site
  • Email the Postmaster
  • Tips for posting to public mailing lists
Re: Regd. "restricted" flag value in Kext
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Regd. "restricted" flag value in Kext

  • Subject: Re: Regd. "restricted" flag value in Kext
  • From: Charu Tiwari <email@hidden>
  • Date: Mon, 07 Sep 2015 20:08:27 +0530
Hi Richard,
    Thanks a lot for the information. It will surely help me in digging a little deeper and figure out how to use it in kernel/userland. 

Regards,
~Charu


Regards,
~Charu

On Mon, Sep 7, 2015 at 7:51 PM, Richard Hamilton <email@hidden> wrote:
Pretty sure if you look at /usr/include/sys/stat.h, what "ls" is showing above corresponds to the line
#define SF_RESTRICTED   0x00080000      /* restricted access */

which is one of the bits that can be in the st_flags member of the stat structure (a field that's not common to all Unix flavors!).

I don't have El Capitan beta installed, but that's in the include file on Yosemite, too.

On Yosemite, I can set and clear the flag as root (using chflags(1), or from C, chflags(2)).  I haven't yet grabbed the latest Yosemite source, untarred it all, and grepped for SF_RESTRICTED, so I don't know what if anything it does prior to El Capitan.

sh-3.2# touch /tmp/testfile1
sh-3.2# ls -lO /tmp/testfile1
-rw-r--r--  1 root  wheel  - 0 Sep  7 10:14 /tmp/testfile1
sh-3.2# chflags restricted /tmp/testfile1
sh-3.2# ls -lO /tmp/testfile1
-rw-r--r--  1 root  wheel  restricted 0 Sep  7 10:14 /tmp/testfile1
sh-3.2# chflags 0 /tmp/testfile1
sh-3.2# ls -lO /tmp/testfile1
-rw-r--r--  1 root  wheel  - 0 Sep  7 10:14 /tmp/testfile1



On Mon, Sep 7, 2015 at 8:21 AM, Charu Tiwari <email@hidden> wrote:
Hi Everyone,
    in MAC OS X 10.11 Apple has introduced "System Integrity Protection" feature which makes some of the system folder and applications 'rootless".

if we run "ls -lO" command on file/folder we can see 'restricted' flag set for file/folder.

ls -lO /sbin/mount_nfs 

-r-xr-xr-x  1 root  wheel  restricted,compressed 46880 Aug 28 12:32 /sbin/mount_nfs

Is there any API provided in kernel extension to find out if the "restricted" bit is set on a particular file/folder.


Thanks and Regards,
~Charu

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden


 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden
  • Follow-Ups:
    • Re: Regd. "restricted" flag value in Kext
      • From: Richard Hamilton <email@hidden>
References: 
 >Regd. "restricted" flag value in Kext (From: Charu Tiwari <email@hidden>)
 >Re: Regd. "restricted" flag value in Kext (From: Richard Hamilton <email@hidden>)

  • Prev by Date: Re: Regd. "restricted" flag value in Kext
  • Next by Date: Re: Regd. "restricted" flag value in Kext
  • Previous by thread: Re: Regd. "restricted" flag value in Kext
  • Next by thread: Re: Regd. "restricted" flag value in Kext
  • Index(es):
    • Date
    • Thread