July 2007 - Darwin-dev - lists.apple.com

File System Filter and Disk Eject
by Duane Murphy 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hell Folks, I'm working on a file system filter kext. The kext fails to unload and the disk it is attached to fails to completely eject. By completely eject, I mean that the volume is removed from the Finders desktop, but disk utility still shows the disk and the volume grayed out. (The volume can even be remounted.) Selecting the disk in disk utility and selecting Eject gives an error message indicating open resources. For various reasons, the kext keeps an open connection (using open()) to it's provider. If that connection is closed then the disk can be ejected. Clearly I'm at fault here, so I am looking for suggestions. Note that if the disk is removed (ie a flash drive), the kext cleans up and is removed because I override willTerminate() to clean up. Clearly this is too late. I'd like to find out what I can do to determine that the disk is trying to be ejected so that I can clean up and remove my connection. I have no problem removing the connection, I just need to know when. I've looked at the terminate chain (terminate, requestTerminate, willTerminate, terminateClient) but those are too late. They seem to be called when the media is removed and you have no choice. Thanks for your suggestions. ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Execute problem for a binary on MAC 10.5 with NTFS partition
by John Francini 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

[darwin-dev] reading /dev/random from a kext
by Alexander von Below 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hello, Could someone show me a pointer? Thanks Alex _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I have previously been pointed to using /dev/random as described in random (4), but I am too stupid to find any way of opening it from kernel space. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Execute problem for a binary on MAC 10.5 with NTFS partition
by Shawn Erickson 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using VFS operations for a given nod
by Shawn Erickson 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Jul 26, 2007, at 12:48 AM, Standard Azi wrote: -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… If there was KPI exposed for reading extended attributes, then yes. Unfortunately there is no such KPI exposed, and so you're in a position where you will have to ship your operation out to user space. As I've already mentioned in another reply related to this message, the main concern with userspace is *performance*. Hooking KAUTH_SCOPE_FILEOP is already a performance issue per se. Now imagine communicating with userland for each open() call, and acting differently in only 20-30% of cases. That's why the application design at the moment communicates with userland only when we find the specific attribute set. Sometimes you have to give a higher priority to performance omitting clever design. (and, don't think I like that). I assure you Michael is well aware of the performance implications... his was just pointing out what you have to work with. What you have to work with isn't going to change without Apple deciding to enhance their KPI and it won't magically show up on 10.4 or earlier (possibly not 10.5 at this point either). So it comes down to you needing to decide on following the rules or breaking them with the later becoming a potential maintenance nightmare with your product breaking with security or software updates (assuming you can find a solution, Apple folks aren't likely to help you break the rules). This email sent to site_archiver(a)lists.apple.com

1 0

RE: Execute problem for a binary on MAC 10.5 with NTFS partition
by Gaurav Kumar 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcfPiob1DGxDFA3tSP2LjfHPITYBqwAA9yIA _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Execute problem for a binary on MAC 10.5 with NTFS partition
by Alexander von Below 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Execute problem for a binary on MAC 10.5 with NTFS partition
by Gaurav Kumar 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcfPiD1wE6wpk+64SxKO0IgL0+7uqg== _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using VFS operations for a given nod
by Standard Azi 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=eghjPamaOMPlZJi2leqVNsqQCWvVxSfDNU8S994B+U27hbsDTuXwygoKLa+ONtmhwbb4goAjnEzPLGwZ4zsfPnuLZ5zMkgWVIt1G93dTCTT9WkBr7jWH9VUXMtxAhs2Kgzbh6BQF6qwOuV7tyV3kjyKfFJRvFslafE3dc6Qawyc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=h/yyKJf4FHyS0+uBU25VcmvY4PhxNh3776AHytubSSyN1Rgh49SPXWayIbwkXVDYdUyLPw3F+elbxnQPyecgh7Ll3xzssujTpiI7ftySIsyWMk+WzX81lk9nT14YYI37Y4zuLO+et+O6ZJ1zAqn7PBtjOvYgH1uczfIpSOmo7Cs= Hello, On 7/26/07, Michael Smith <msmith(a)freebsd.org> wrote: When you say "holds some meaningful data for the kernel", I assume that what you mean is that it holds some meaningful data for your decision-making code. Correct. You haven't given any sort of criteria here to work with, so of course I can't answer you. That's true, but I can't get too much into detail for now - I hope you understand. If there was KPI exposed for reading extended attributes, then yes. Unfortunately there is no such KPI exposed, and so you're in a position where you will have to ship your operation out to user space. As I've already mentioned in another reply related to this message, the main concern with userspace is *performance*. Hooking KAUTH_SCOPE_FILEOP is already a performance issue per se. Now imagine communicating with userland for each open() call, and acting differently in only 20-30% of cases. That's why the application design at the moment communicates with userland only when we find the specific attribute set. Sometimes you have to give a higher priority to performance omitting clever design. (and, don't think I like that). I would, however, also file an enhancement request at bugreporter.apple.com asking for an interface to do what you want inside the kernel. In your case, providing you're only trying to operate on the file that's the object of the authorisation operation, you're right - your case is a legitimate exception. Well, if that's all that it has to be done, I could simply implement that KPI thing by myself and then try to put it in the bug report as a patch proposal. (it works that way in the Linux world :-) ). I'd only have to be given a few pointers on where to proceed. Thanks for your constructive help! On Jul 25, 2007, at 12:04 PM, darwin-dev-request(a)lists.apple.com wrote: >> As a general rule, if you think you want to initiate operations on >> files, file attributes, pathnames etc. from the kernel you have made >> a design error and need to stop and re-evaluate what you are doing. > > That's usually true although I don't see any other method that is more > elegant - maybe you do, so let me explain what I'm trying to do : > > === > - open() is hooked with Kauth > > - if there is some special extended attribute set on the opening file, > handle some security issues before returning a file descriptor, else, > return the proper fd. > === > > Do you see any other way to keep track of the files handled by the > security module? (please note that the extended attribute holds some > meaningful data for the kernel) When you say "holds some meaningful data for the kernel", I assume that what you mean is that it holds some meaningful data for your decision-making code. > Sure, now we can question about the purpose of the security module, > why it has to rely on userspace data, etc... but focusing on the > approach I've described, do you see any other solution to keep track > about which files to handle in a special manner? You haven't given any sort of criteria here to work with, so of course I can't answer you. >> In almost every case, what you are trying to do should be handled in >> user space. > > I'd say this is an exception. If there was KPI exposed for reading extended attributes, then yes. Unfortunately there is no such KPI exposed, and so you're in a position where you will have to ship your operation out to user space. I would, however, also file an enhancement request at bugreporter.apple.com asking for an interface to do what you want inside the kernel. In your case, providing you're only trying to operate on the file that's the object of the authorisation operation, you're right - your case is a legitimate exception. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 7/26/07, Michael Smith <msmith(a)freebsd.org> wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using VFS operations for a given node
by Terry Lambert 26 Jul '07

26 Jul '07

site_archiver(a)lists.apple.com Delivered-To: Darwin-dev(a)lists.apple.com -- Terry Hello! The approach you described is obviously *valid* although it's rather complicated compared to simply calling getxattr(). Another concern in this case would be performance.. Hooking all open() calls of which only 20% shall be handled in a different manner, and, for each open() call , communicating with userspace is a bit too much of an overhead - that's why I'd still like to use v_op. - open is trapped by a kauth module - the user space daemon looks at the extended attribute information, and makes a decision - the user space daemon igures out an answer - the user spce daemon returns the answer to the kauth module See above. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… KPIs are KPIs because they usually won't break in the normal course of events, unless there's no other reasonable way to fix a bug or add a new feature, without breaking them. The assurance that "you're probably not going to have to recompile your code every time there's a software update to keep your KEXT loading successfully" comes at a cost with KPIs, just like any other API gating mechanism. I don't expect that you would be able to make what you want to work in any case, but if you did, it would end up being a maintenance nightmare for you. On Jul 26, 2007, at 12:10 AM, Standard Azi wrote: On 7/26/07, Terry Lambert <tlambert(a)apple.com> wrote: On Jul 25, 2007, at 4:52 AM, Standard Azi wrote: >> As a general rule, if you think you want to initiate operations on >> files, file attributes, pathnames etc. from the kernel you have made >> a design error and need to stop and re-evaluate what you are doing. > > That's usually true although I don't see any other method that is more > elegant - maybe you do, so let me explain what I'm trying to do : > > === > - open() is hooked with Kauth > > - if there is some special extended attribute set on the opening file, > handle some security issues before returning a file descriptor, else, > return the proper fd. > === > > Do you see any other way to keep track of the files handled by the > security module? (please note that the extended attribute holds some > meaningful data for the kernel) - the kauth module send a message to a user space daemon that has registered with the kauth module earlier so that the module knows it's there and alive - if the user space daemon has to call any operations on the file that are trapped by the kauth module, then because it has registered with the module, it's operations are simply permitted, rather than recursively calling back out to user space - the kauth module permits/denies the operation based on the answer it has received > Sure, now we can question about the purpose of the security module, > why it has to rely on userspace data, etc... but focusing on the > approach I've described, do you see any other solution to keep track > about which files to handle in a special manner? >> In almost every case, what you are trying to do should be handled in >> user space. > > I'd say this is an exception. I'd say it wasn't; most work, particularly work that could take a long time or block things long enough that they get a spinny beach ball/ wheel of fortune/pizza of death/whatever you like to call the cursor for an unresponsive application. This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0