October 2008 - Darwin-dev - lists.apple.com

Re: setuid for priv sockets?
by Terry Lambert 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 30, 2008, at 4:09 PM, Brian Mastenbrook wrote: On Oct 30, 2008, at 2:41 PM, Terry Lambert wrote: For capabilities based security models, all the capabilities that will ever be available to the OS are created when the OS is started. The problem with this approach is that it ignores the ability to enter and leave security associations, or otherwise find some way to escalate privilege beyond what you start with; on top of that, you have the problem of initialization. For a capabilities based OS like EROS, this last one is side stepped by creating the OS image instance with the instances preinitialized. But even so, the model is a non-starter. Any time you join or leave a security association, you must by definition engage in privilege escalation and deescalation, or talk to a gatekeeper with the capability you want to inherit, and which is therefore an attack surface. Even if you solved that, you still have the problem of peer recognition, and, up the chain of trust, that the person telling you to recognize a peer is a person authorized to do so, etc.. I am somewhat confused by what you are saying, as my prior exposure to the capabilities model is within the context of the actors model (for example, as implemented in E) where it definitely is possible to create a capability after the system is started. This is probably a bit of a tangent for darwin-dev; I'd be happy to discuss further over private mail. I really don't understand how you could possibly use that approach to add a new capability which, for example, allows an otherwise normal process to create privileged ports, if that granularity wasn't there in the first place. You'd of necessity need to have rights to define the capability, and you'd have to have rights to assign that capability, and you'd have to have an apriori knowledge of that as a discrete security boundary crossing event within the kernel itself, and an interposition enforcement checkpoint. All I see happening from this is moving the target surface, not eliminating it. If I can't attach a process "bob" which was setuid to enable it to get a privileged port, because what I want is a different privilege than that one, then I'll just attack the process by which privileges are created or the process by which privileges are assigned to process "bob", etc.. It's like yelling "Look! A pony!". The weak link is always going to be (1) the human who is asked to add privileges, or (2) the system's recognition that a given human is in fact the right human to permit to add privileges. I actually expect things would be worse than that; the only model that really works for interposition checkpoints is to allow multiple control agencies, and if anyone says anything other than "Yes" or "I don't care", then the answer is "No". Since the default answer is "No" for privileged ports, there's no way you could change the answer to "Yes" without allowing the policy to change the default. Otherwise I can just get a "Yes man" policy loaded at some point, and all your guards look the other way. The reason I brought up privileged ports is that this is one of the examples given in BetterAuthorizationSample, and despite the complicated attempt to provide only the ability to open up certain ports to the requesting process, the ability to do anything which requires admin privileges is provided to any process which is running as the requesting process's user. Sorry, I don't know from BetterAuthorizationSample. I just manage the credential code by which user space establishes identities to the kernel. I deal with 32 bit integers or interfaces to ask a privileged process in user space to trade things I don't know from Adam for nice 32 bit integers. 8-). Internally to the kernel, we *have* an actor model: all our kauth questions are of the form "Is actor X allowed to perform operation Y on taget Z?". If you want, I suggest you file a bug against BetterAuthorizationSample to get them to pick a different example. This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc errors / fragmentation?
by Shawn Erickson 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=eDB/ib+zCxWzubT22d7tqzvk1chPShS+TXP+zwrsOFc=; b=F/IwQu7MsGJVVHXfl4O1SGYDOQHwvCHso9douvrXC3lQIiagTtGDFWIIB8yV7kZ1f3 dlTQs3O2HPNUewbw5taoVchBujjK2AEqFB/1KcWR89wCZXWmE3Q3Wo+sl1mUGPEn+J1j s1NjfMr+/PH0U8ruwuUYdSukFNhGey1rdVcyA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=n8yv7QO4+b4LiVMI83NGlgnZYDkK76CHngKrrYk4gWrfNgK2dqX+ssBWFLHeq2Oluk M0xmh3Gg1HEBjmFvn1ZrK0Y1jxagCwjkDWnAl5G0Kd9BatZZfjS5xDaAshzFsoleT8CU llR/Vg7nE09ju68c3xycYuUcxu0klmJb5R+Ws= On Fri, Oct 31, 2008 at 8:23 AM, Jay Levitt <lists-darwin-dev(a)jay.fm> wrote: > Eric Gouriou wrote: >> >> On Oct 30, 2008, at 3:41 PM, Jay Levitt wrote: >>> >>> I'm seeing the same thing on my 16GB Mac Pro (early 2008, OS X 10.5.5). >>> I'm getting crashes every few days in WindowServer or coreservicesd; >>> MenuMeters and Activity Monitor say I've got plenty of available RAM (either >>> unused or idle). system.log says: >>> >>> system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: >>> coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error >>> code=12) >> >> I suggest keeping top or Activity Monitor around and, when you see a >> large >> growth in RPRVT or when VSIZE gets around ~3GB, capture heap / vmmap / >> leaks > > Thanks - that helps a lot. > > Is there a way for me to keep an eye on the "largest contiguous block on the > free list", or something like that? I haven't done any dev on Darwin, so I > don't know much about debugging it. vmmap lists the virtual memory ranges that have been mapped you could do a little math to figure out what is available. -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc errors / fragmentation?
by Terry Lambert 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thanks - that helps a lot. Address map entries track what's used, not what's available to be used. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 31, 2008, at 8:23 AM, Jay Levitt <lists-darwin-dev(a)jay.fm> wrote: Eric Gouriou wrote: On Oct 30, 2008, at 3:41 PM, Jay Levitt wrote: I'm seeing the same thing on my 16GB Mac Pro (early 2008, OS X 10.5.5). I'm getting crashes every few days in WindowServer or coreservicesd; MenuMeters and Activity Monitor say I've got plenty of available RAM (either unused or idle). system.log says: system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd [89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12) I suggest keeping top or Activity Monitor around and, when you see a large growth in RPRVT or when VSIZE gets around ~3GB, capture heap / vmmap / leaks Is there a way for me to keep an eye on the "largest contiguous block on the free list", or something like that? I haven't done any dev on Darwin, so I don't know much about debugging it. You can iteratively examine the process with one or more of several developer tools, and then look at the differences over time to track free space. This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc errors / fragmentation?
by Jay Levitt 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Thanks - that helps a lot. Jay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Eric Gouriou wrote: On Oct 30, 2008, at 3:41 PM, Jay Levitt wrote: I'm seeing the same thing on my 16GB Mac Pro (early 2008, OS X 10.5.5). I'm getting crashes every few days in WindowServer or coreservicesd; MenuMeters and Activity Monitor say I've got plenty of available RAM (either unused or idle). system.log says: system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12) I suggest keeping top or Activity Monitor around and, when you see a large growth in RPRVT or when VSIZE gets around ~3GB, capture heap / vmmap / leaks Is there a way for me to keep an eye on the "largest contiguous block on the free list", or something like that? I haven't done any dev on Darwin, so I don't know much about debugging it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Call sequence 'getpwuid(getuid())' unexpectedly returns NULL
by Justin C. Walker 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 31, 2008, at 07:00 , Sean Gates wrote: Greetings from a new subscriber, [snip] HTH Justin -- Justin C. Walker, Curmudgeon at Large Institute for the Absorption of Federal Funds ----------- My wife 'n kids 'n dogs are gone, I can't get Jesus on the phone, But Ol' Milwaukee's Best is my best friend. ----------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I’m having a problem on Macintosh OSX 10.4 & 10.5 involving user information lookup where the ‘getpwuid(getuid())’ call sequence starts unexpectedly returning NULL after an initial period of successful operation. On some systems the lookup failures start within than a day; on others, no failures have yet been observed. This is a wild guess, too early in the morning, but: do you rewind the password database before use? Check "man getpwuid" for details. This email sent to site_archiver(a)lists.apple.com

1 0

Call sequence 'getpwuid(getuid())' unexpectedly returns NULL
by Sean Gates 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: Ack7CCEBuNhUGSKSQGS06jKsI9kXKw== Thread-topic: Call sequence 'getpwuid(getuid())' unexpectedly returns NULL _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc errors / fragmentation?
by Eric Gouriou 31 Oct '08

31 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Back in May, Sean McBride wrote: Sometimes I see messages like: malloc: *** mmap(size=16883712) failed (error code=12) *** error: can't allocate region *** set a breakpoint in malloc_error_break to debug Eric Jay Levitt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/eric.gouriou%40pobox.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 30, 2008, at 3:41 PM, Jay Levitt wrote: and Eric Gouriou replied: I'd give vmmap a try and look for a VM fragmentation issue. I'm seeing the same thing on my 16GB Mac Pro (early 2008, OS X 10.5.5). I'm getting crashes every few days in WindowServer or coreservicesd; MenuMeters and Activity Monitor say I've got plenty of available RAM (either unused or idle). system.log says: system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12) system.log.0.bz2:Oct 29 14:35:19 macpro coreservicesd[89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12)\n*** error: can't allocate region\n*** set a breakpoint in malloc_error_break to debug system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: *** set a breakpoint in malloc_error_break to debug I've looked at vmmap, and while I get the gist of the output, I'm not sure what I should be looking for to see if the process's memory is fragmented. The -submap display shows plenty of small regions, but since I can't do a vmmap "right before I crash", I'm a little stumped... Can anyone point me at any guidelines, analysis tools, etc? I suggest keeping top or Activity Monitor around and, when you see a large growth in RPRVT or when VSIZE gets around ~3GB, capture heap / vmmap / leaks for the processes of interest and file a bug at <http://bugreport.apple.com/ > with the collected data, also including pre-existing crashlogs for the given process(es) and a system profile. You could also try to figure who are the most frequent callers to mmap in the given process. sudo dtrace -n 'syscall::mmap:entry / execname == "<insert name here>" / { @mstacks[ustack()] = count; }' and Ctrl-C after a bit. Once you file a bug report, Apple engineers may contact you via bugreporter and suggest/request further experiments. This email sent to eric.gouriou(a)pobox.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: setuid for priv sockets?
by Brian Mastenbrook 30 Oct '08

30 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 30, 2008, at 2:41 PM, Terry Lambert wrote: -- Brian Mastenbrook brian(a)mastenbrook.net http://brian.mastenbrook.net/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… For capabilities based security models, all the capabilities that will ever be available to the OS are created when the OS is started. The problem with this approach is that it ignores the ability to enter and leave security associations, or otherwise find some way to escalate privilege beyond what you start with; on top of that, you have the problem of initialization. For a capabilities based OS like EROS, this last one is side stepped by creating the OS image instance with the instances preinitialized. But even so, the model is a non-starter. Any time you join or leave a security association, you must by definition engage in privilege escalation and deescalation, or talk to a gatekeeper with the capability you want to inherit, and which is therefore an attack surface. Even if you solved that, you still have the problem of peer recognition, and, up the chain of trust, that the person telling you to recognize a peer is a person authorized to do so, etc.. I am somewhat confused by what you are saying, as my prior exposure to the capabilities model is within the context of the actors model (for example, as implemented in E) where it definitely is possible to create a capability after the system is started. This is probably a bit of a tangent for darwin-dev; I'd be happy to discuss further over private mail. Ironically, your straw man of privileged ports that you are putting forward in this thread in order to argue this point was an attempt at increasing the granularity of the UNIX security model. The idea was that you escalated privilege as a result of install time rights settings, obtained your privileged port, then dropped privilege. The premise behind this is that machines were so expensive that only trusted parties could afford to buy them, and therefore it was OK to let root on one machine vouchsafe an identity to root on another machine. I would argue that at this point, I could impersonate any machine at the wire traffic level using cheap hardware, and illicit network connectivity is so easy to obtain, that the use of privileged ports is largely useless, outside the computer equivalent of gated communities. I don't disagree with any of this. The reason I brought up privileged ports is that this is one of the examples given in BetterAuthorizationSample, and despite the complicated attempt to provide only the ability to open up certain ports to the requesting process, the ability to do anything which requires admin privileges is provided to any process which is running as the requesting process's user. This email sent to site_archiver(a)lists.apple.com

1 0

malloc errors / fragmentation?
by Jay Levitt 30 Oct '08

30 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Back in May, Sean McBride wrote: Sometimes I see messages like: malloc: *** mmap(size=16883712) failed (error code=12) *** error: can't allocate region *** set a breakpoint in malloc_error_break to debug Can anyone point me at any guidelines, analysis tools, etc? Jay Levitt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… and Eric Gouriou replied: I'd give vmmap a try and look for a VM fragmentation issue. I'm seeing the same thing on my 16GB Mac Pro (early 2008, OS X 10.5.5). I'm getting crashes every few days in WindowServer or coreservicesd; MenuMeters and Activity Monitor say I've got plenty of available RAM (either unused or idle). system.log says: system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12) system.log.0.bz2:Oct 29 14:35:19 macpro coreservicesd[89]: coreservicesd(89,0xa0220fa0) malloc: *** mmap(size=16777216) failed (error code=12)\n*** error: can't allocate region\n*** set a breakpoint in malloc_error_break to debug system.log.0.bz2:Oct 29 14:35:19 macpro com.apple.coreservicesd[89]: *** set a breakpoint in malloc_error_break to debug I've looked at vmmap, and while I get the gist of the output, I'm not sure what I should be looking for to see if the process's memory is fragmented. The -submap display shows plenty of small regions, but since I can't do a vmmap "right before I crash", I'm a little stumped... This email sent to site_archiver(a)lists.apple.com

1 0

Re: setuid for priv sockets?
by Terry Lambert 30 Oct '08

30 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com - -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 27, 2008, at 4:11 PM, Brian Mastenbrook wrote: What's needed is a very fine grained set of capabilities, along with the ability to selectively grant those capabilities to an application at either installation or execution time (with corresponding limitations on the ability to influence the execution environment ala the existing restrictions for setuid binaries). For capabilities based security models, all the capabilities that will ever be available to the OS are created when the OS is started. The problem with this approach is that it ignores the ability to enter and leave security associations, or otherwise find some way to escalate privilege beyond what you start with; on top of that, you have the problem of initialization. For a capabilities based OS like EROS, this last one is side stepped by creating the OS image instance with the instances preinitialized. But even so, the model is a non- starter. Any time you join or leave a security association, you must by definition engage in privilege escalation and deescalation, or talk to a gatekeeper with the capability you want to inherit, and which is therefore an attack surface. Even if you solved that, you still have the problem of peer recognition, and, up the chain of trust, that the person telling you to recognize a peer is a person authorized to do so, etc.. As far as installation time grants, historically computer scientists have called those "installed images". VMS had this ability, for example. I'm not, in principle, against those, as long as there is some other user controllable way to get the same rights for my software that are being granted by my OS and OS vendor to some other software vendor installing code on my machine. If I paid for the atoms, I own them, and they will freaking well do what I tell them to do. Ironically, your straw man of privileged ports that you are putting forward in this thread in order to argue this point was an attempt at increasing the granularity of the UNIX security model. The idea was that you escalated privilege as a result of install time rights settings, obtained your privileged port, then dropped privilege. The premise behind this is that machines were so expensive that only trusted parties could afford to buy them, and therefore it was OK to let root on one machine vouchsafe an identity to root on another machine. I would argue that at this point, I could impersonate any machine at the wire traffic level using cheap hardware, and illicit network connectivity is so easy to obtain, that the use of privileged ports is largely useless, outside the computer equivalent of gated communities. This email sent to site_archiver(a)lists.apple.com

1 0