August 2007 - Darwin-dev - lists.apple.com

Re: IOKit KEXT Questions
by Terry Lambert 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Several ways: Do we *really* need to send a feature request to [...] provide a truly authorized KPI for legitimate patches? Only if you want the KPI to actually get implemented. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 16, 2007, at 9:29 AM, Ernesto Corvi wrote: On Aug 15, 2007, at 7:24 PM, Terry Lambert wrote: We hide system calls so someone unscrupulous does not overwrite their entry points with jump instructions to their own code, perhaps thinking that we do not change locking or other implementations details in software updates. If you need to trap and/or prevent this type of operation for legitimate reasons, use kauth instead. How is that going to prevent any unscrupulous people from hooking into the kernel? I'm baffled. (1) By providing KPI which will not destabilize the kernel when you use it (2) By being responsive to reasonable requests for new KPI that come through proper channels; going through proper chanlles gets you an advocate in DTS to push your request (3) By making it more work to go around the KPI than to use the KPI; it's not impossible to do this; it's just intentionally painful: that's why this discussion really has nothing to do with security (4) Through peer pressure/Professional ethics ["You should care about not breaking my app so I care about not breaking yours"] An unscrupulous person most likely doesn't care at all if his code runs with the next software update. And this is precisely what makes them unscrupulous, whether they are a garage developer or employed by a Fortune 500 company. BTW: a "scruple", according to Webster's dictionary, is "an ethical consideration or principle that inhibits action". Unlike user space instability, which will impact at most one or two applications (usually the ones that are unstable to start with), kernel space instability impacts everyone. When writing code that runs in the kernel address space (a KEXT), there is necessarily a higher standard to which a professional needs to hold themselves. This higher standard is not obvious unless the engineer has either worked in a kernel or programmed on a machine without memory protection before; that's one of the reasons I said that the original post was to the wrong mailing list -- it should have been posted to "kernel", not "dev", where people just take this idea for granted. Requests from developers carry much more weight with feature planners than do comments by insiders who "saw something on some mailing list". This is why people constantly suggest you file bug reports. Even if you happen to be chatting on a mailing list with the person who will eventually get that bug report, or be tasked with implementing the feature, that's not really going to carry any weight with feature planners, who give more weight to documented customer demand for something. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Alexei Kosut 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Alexei _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 15, 2007, at 10:33 PM, Matt Burnett wrote: Regarding the linking against the entire kernel, do non-IOKit KEXTs link against the entire kernel by default and IOKit KEXTs do not, or is this another reason why my IOKit KEXT can not resolve execve? All kexts are basically the same; their Info.plist defines which other modules they link against, and those are the symbols they will resolve to. I'm a little surprised you were able to get any kext, IOKit or non, to resolve execve. I'm pretty sure it's not exported by any of the kernel symbol sets. How are you linking your kext? What does its Info.plist look like? This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Ernesto Corvi 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Things that use kauth are a legitimate 'patches'. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 16, 2007, at 12:48 PM, Amanda Walker wrote: On Aug 16, 2007, at 12:29 PM, Ernesto Corvi wrote: Do we *really* need to send a feature request to harden the security on the kernel and provide a truly authorized KPI for legitimate patches? What is a "legitimate patch?" KPIs like kauth let a 3rd party product interpose itself into kernel processing at well defined spots without having to patch it. The only reason to "patch" the kernel is to fix a bug in a particular kernel version if Apple isn't willing to roll a fix into the next update (which happened in Tiger once most of the engineers were concentrating on Leopard). You mean the only reason to patch the kernel for well-intentioned people. I can tell you a lot of reasons why a malware write would like to patch the kernel. But it's a fallback. Start by describing what you're trying to do and ask for a KPI to do it (via bugreporter.apple.com so that it gets tracked). Saying "I want a generic way to patch the kernel" doesn't make a lot of sense. I think you responded to the wrong email. Where did I say "I want a generic way to patch the kernel"? I actually want the opposite. I want the the kernel not to be generically patchable, as it is right now, and be able to have a KPI, such as kauth (although kauth is severely limited in scope right now) where benevolent users can actually implement the kernel hooks they need. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Disk Arbitration: Preventing the disk insertion (unrecognized volume) dialog
by Ron Aldrich 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thanks, Dan. That's solved it. Best Regards, Ron Aldrich Software Architects, Inc. On Aug 16, 2007, at 7:26 AM, Dan Markarian wrote: Hey Ron, Dan On 15 Aug 2007, at 9:05 PM, Ron Aldrich wrote: Folks, This is where things go bad. The driver creates an IOMedia object for the freshly formatted disk. My disk appeared callback gets called. So, how should I be intercepting that dialog? Thanks for your time, Ron Aldrich Software Architects, Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I have to agree with the other folks who say that "minimal" is about the most polite description they can come up with for the state of the documentation for the Disk Arbitration framework, and while the source code to disktool is a useful example, it does appear to use a lot of private, or at least deprecated APIs (although, it may be that I just need newer source). Hopefully the copy of "Mac OS X Internals: A Systems Approach" I just ordered from Amazon will shed better light on the APIs. You must use DADiskPeekCallback() to issue the DADiskClaim() ahead of time. I'm working on a disk formatting utility to support some specialized media and file system types, and I'm running into a bit of a problem with Disk Arbitration. I don't seem to be able to prevent the disk insertion (unrecognized volume) dialog from appearing after I issue a low- level format call to the device. Currently, I use diskutil to unmount the disk (if it was mounted - it's possible that there is unformatted media in the drive, and therefore no IOMedia object). I register a disk appeared callback to the Disk Arbitration framework. I then ask the driver to format the media - if it had an IOMedia object, it tears it down, and formats the disk, and re-enables polling. In the disk appeared callback, I call DADiskClaim, in an attempt to prevent the unrecognized volume dialog from appearing. Apparently it's too late at this point. My diskClaimed callback gets called, the disk gets partitioned, and everything proceeds normally, except that there is an unwanted dialog on the screen. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/markarian% 40apple.com This email sent to markarian(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Linking .a vs. .dylib
by Conrad G T Yoder 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcfgQVGbj+NtZkw0EdySBgARJHiCXA== Thread-topic: Linking .a vs. .dylib User-agent: Microsoft-Entourage/11.3.6.070618 Running gcc 4.0.1 build 5341, ld cctools-590.42.1.obj-1 (Xcode 2.3) on i386 OS X 10.4.10. I am having an issue when I link with a static lib, arg lists of calls to functions in that static lib get "messed up" - the value of the first parameter ("this" pointer; it is a C++ lib) is gone and the first arg in the fn parameters gets assigned to "this", the value of the 2nd arg gets assigned to the first arg, etc. I don't have this problem with linking with the dynamic version of this lib - the "this" pointer has the correct value, along with the regular fn arguments. I don't have access to the source or am able to compile these libs; I am just able to link to them. Could this be something wrong with the static version of the compiled lib? Something I am missing in the options of ld or libtool when linking to the static lib? Thanks for any suggestions here. -Conrad -- Strength Through Faith Faith Through Unity _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Shaun Wexler 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Aug 15, 2007, at 5:40 PM, Matt Burnett wrote: -- Shaun Wexler MacFOH http://www.macfoh.com "Anger dwells only in the bosom of fools." - Albert Einstein _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com You didnt answer my question, and you jumped to conclusions. I all ready have functioning code to arbitrarily hook kernel functions. I didn't ask for help on how to do this, i just asked if there are any IOKit classes that implement features similar to mprotect/ vm_protect, and why IOKit based KEXTs have issues resolving symbols in the kernel. Not answering these questions wont prevent me from accomplishing my task. - I can still use mprotect/vm_protect - For the symbols issue, i can at the very worst use some script hackery to resolve the symbols in user space and transfer their addresses to my KEXT. I know there are tables in the kernel where i could resolve the symbols manually as well. I would like to remind you that hurling insults at me such as "unscrupulous" (definition: having or showing no moral principles; not honest or fair) does nothing other than provoke me to release a SDK to the public which would allow people to hook kernel functions. Dude, take some Midol and re-read Terry's reply. He implied nothing, and simply chose to answer your 2nd question instead of the 1st, and did so quite well. BTW, you won't get many offers of help around here with that attitude. smime.p7s

1 0

Re: Rereading A Partition Table
by Duane Murphy 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com --- At Thu, 16 Aug 2007 12:20:05 -0400, Dan Markarian wrote: >Hey Duane, > >You have to eliminate O_SHLOCK then. You can use Disk Arbitration to >unmount all the volumes on the disk first. Thanks Dan. That works well. ...Duane >On 16 Aug 2007, at 11:38 AM, Duane Murphy wrote: > >> --- At Thu, 16 Aug 2007 10:53:50 -0400, Dan Markarian wrote: >> >>> Hey Duane, >>> >>> We do not detect live changes to a partition map in Tiger. >> >> Thanks. Then I am back to my original question. When Disk Utility >> (diskutil) partitions a drive it takes it off-line then puts it back >> on- >> line. Clearly this causes everything to be re-read. >> >> I'd like to do the same thing. Disk Arbitration doesn't seem quite the >> right tool for doing this. In fact even Disk Utility does not fully >> "eject" a firewire disk unless it is partitioning. >> >> I surely don't want to request the user to restart just to re-read >> changes to a disk. >> >> Is there somewhere I should look for how to do this? Another mailing >> list? >> >> Thanks for the help. >> >>> On 15 Aug 2007, at 9:58 PM, Duane Murphy wrote: >>> >>>> --- At Wed, 15 Aug 2007 17:26:42 -0700, Chris Sarcone wrote: >>>> >>>>> Duane -- >>>>> >>>>> I'm making changes to GUID partition disks partition table, and I >>>>> would >>>>> like the system to re-read the disk in order to recognize new >>>>> partitions >>>>> on the disk. >>>>> >>>>> What do I need to do to get the system to re-read the disk and >>>>> recognize >>>>> the changes? >>>>> >>>>> I've tried several disk util commands (unmountDisk, mountDisk, and >>>>> eject) but they don't re-read the disk. >>>>> >>>>> Disk Utility->Eject does the same thing (ie nothing). >>>>> >>>>> I note that this is a FireWire drive, but it could also be an >>>>> internal >>>>> drive or any other non-network drive. >>>>> >>>>> For example, when Disk Utility partitions a disk, it fully unmounts >>>>> and >>>>> then remounts the disk. How can I do the same thing? >>>>> >>>>> Try opening and closing the raw disk node for the whole device. >>>>> >>>> >>>> Hi Chris, >>>> That's what I was told. In fact, I am editing the partition table >>>> using / >>>> dev/rdisk1 >>>> (or whatever number). But when it is closed it doesn't do anything. >>>> >>>> Here's how I open. inDisk is "/dev/rdisk1" (for example); >>>> int diskDescriptor >>>> = open( inDisk, O_RDWR | O_SHLOCK, S_IRUSR | S_IWUSR | S_IRGRP ); >>>> >>>> later I just >>>> >>>> close( diskDescriptor ); >>>> >>>> There's no errors and in fact, the disk is nicely edited. If I >>>> unplug >>>> the drive and plug it back in the partitions looks exactly like >>>> what I >>>> want, but it's hard to do that for internal disks. :-) ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Amanda Walker 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com What is a "legitimate patch?" Amanda Walker _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 16, 2007, at 12:29 PM, Ernesto Corvi wrote: Do we *really* need to send a feature request to harden the security on the kernel and provide a truly authorized KPI for legitimate patches? KPIs like kauth let a 3rd party product interpose itself into kernel processing at well defined spots without having to patch it. The only reason to "patch" the kernel is to fix a bug in a particular kernel version if Apple isn't willing to roll a fix into the next update (which happened in Tiger once most of the engineers were concentrating on Leopard). But it's a fallback. Start by describing what you're trying to do and ask for a KPI to do it (via bugreporter.apple.com so that it gets tracked). Saying "I want a generic way to patch the kernel" doesn't make a lot of sense. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Ernesto Corvi 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 15, 2007, at 7:24 PM, Terry Lambert wrote: We hide system calls so someone unscrupulous does not overwrite their entry points with jump instructions to their own code, perhaps thinking that we do not change locking or other implementations details in software updates. If you need to trap and/or prevent this type of operation for legitimate reasons, use kauth instead. How is that going to prevent any unscrupulous people from hooking into the kernel? I'm baffled. An unscrupulous person most likely doesn't care at all if his code runs with the next software update. By the time the next software update comes around, he already did his key-logging, ran his daemons and potentially completely compromised the system. Do we *really* need to send a feature request to harden the security on the kernel and provide a truly authorized KPI for legitimate patches? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Rereading A Partition Table
by Dan Markarian 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hey Duane, Dan On 16 Aug 2007, at 11:38 AM, Duane Murphy wrote: --- At Thu, 16 Aug 2007 10:53:50 -0400, Dan Markarian wrote: Hey Duane, I'd like to do the same thing. Disk Arbitration doesn't seem quite the right tool for doing this. In fact even Disk Utility does not fully "eject" a firewire disk unless it is partitioning. I surely don't want to request the user to restart just to re-read changes to a disk. Thanks for the help. On 15 Aug 2007, at 9:58 PM, Duane Murphy wrote: --- At Wed, 15 Aug 2007 17:26:42 -0700, Chris Sarcone wrote: Duane -- I'm making changes to GUID partition disks partition table, and I would like the system to re-read the disk in order to recognize new partitions on the disk. What do I need to do to get the system to re-read the disk and recognize the changes? I've tried several disk util commands (unmountDisk, mountDisk, and eject) but they don't re-read the disk. Disk Utility->Eject does the same thing (ie nothing). I note that this is a FireWire drive, but it could also be an internal drive or any other non-network drive. For example, when Disk Utility partitions a disk, it fully unmounts and then remounts the disk. How can I do the same thing? Try opening and closing the raw disk node for the whole device. Hi Chris, That's what I was told. In fact, I am editing the partition table using / dev/rdisk1 (or whatever number). But when it is closed it doesn't do anything. Here's how I open. inDisk is "/dev/rdisk1" (for example); int diskDescriptor = open( inDisk, O_RDWR | O_SHLOCK, S_IRUSR | S_IWUSR | S_IRGRP ); later I just close( diskDescriptor ); ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… You have to eliminate O_SHLOCK then. You can use Disk Arbitration to unmount all the volumes on the disk first. We do not detect live changes to a partition map in Tiger. Thanks. Then I am back to my original question. When Disk Utility (diskutil) partitions a drive it takes it off-line then puts it back on- line. Clearly this causes everything to be re-read. Is there somewhere I should look for how to do this? Another mailing list? There's no errors and in fact, the disk is nicely edited. If I unplug the drive and plug it back in the partitions looks exactly like what I want, but it's hard to do that for internal disks. :-) This email sent to site_archiver(a)lists.apple.com

1 0