October 2008 - Darwin-dev - lists.apple.com

Re: mstackrealign, update_prebinding and the misaligned_stack_error crashes
by Terry Lambert 30 Oct '08

30 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

mstackrealign, update_prebinding and the misaligned_stack_error crashes
by Sorin Negoita 30 Oct '08

30 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type; bh=+ACOGTIQ5XgUDlqzj4/Ou5YSwiiyr7Cx1jyHA2mwYW8=; b=xzqlxDWqSdItAA+QKNLyFtOzbD+kcIV4GdERfIHbBDiyak2SD97WfSnHc3phQDGPgI u15QsKBrOft+fQi9R6KQPf77IMPWObtoG1A68QD2jLZq7Wif0++FosIeEAo3q6dnhQhH ivIJRkjLtjZNUazXqhh3p+vpkHXI8LoqhNvF4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=dUj2FZAD16P8+cGWI5DmgLAKIGEFXOYL4vnRZ7lvUULxxQsrbPzsE3UC9MfGA+Y0aY uXr//t1MSzFoQBRd5F6YGqytvE7uTE4v6yA3kSeWJPJa17oPo197QF5divgTLFg+z2Qh 9uFA3rnXc6G7DGiHTope2NUbSmXA3Aixd4/1s= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

"Purity" patches for IOKitUser, launchd, objc4
by probono 29 Oct '08

29 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Darwin community, as you might have experienced, the current published sources of some Darwin 9 projects, including such essential ones as IOKitUser, launchd, objc4 currently have build- or runtime dependencies on projects that are not part of Darwin. It looks like patching the respective sources to remove the non-Darwin dependencies is the most pragmatic approach at this time. Hence, Aladin from the PureDarwin project has made available a series of patches. You can use the following plist to have DarwinBuild use the patches: http://code.google.com/p/puredarwin/source/browse/trunk/plists/9F33pd1.plist For more detailed instructions on how to use it, please see http://www.puredarwin.org/developers/darwinbuild While these patches might not be the cleanest way of doing things, they appear to work as intended. We'd appreciate your feedback and contributions. The PureDarwin project is open to everyone who helps to make Darwin more usable. Of course we still hope that the Apple-provided Darwin sources will not contain build- or runtime dependencies ("impurities") to projects that are unavailable to Darwin in the future, removing the need for such patches going forward. Simon -- www.puredarwin.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Weakly-Linked Symbols
by Eric Gouriou 29 Oct '08

29 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 28, 2008, at 9:39 PM, Dave Keck wrote: Hey everyone, This is the most appropriate list I could find for this question pertaining to building weakly-linked libraries and frameworks. Here's a quote from http://developer.apple.com/documentation/MacOSX/Conceptual/BPFrameworks/Con… "Note: When checking for the existence of a symbol, you must explicitly compare it to NULL or nil in your code. You cannot use the negation operator ( ! ) to negate the address of the symbol." I was simply wondering why this is - what's different between this: if ( !mySymbol ) and this: if ( mySymbol == NULL ) to check whether the symbol exists or not? My understanding of C seems to suggest that comparing something with NULL would be precisely the same thing as comparing it with 0 (overlooking the (void *) cast). Eric Thanks for any insight! David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/eric.gouriou%40pobox.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I can only guess that this advice was meant to avoid a compiler optimisation that would defeat the check "if (!mySymbol)" but not "if (mySymbol == NULL)". Unfortunately current gcc releases end up assuming that no symbol can be NULL either and also optimize away the "if (mySymbol == NULL)" check. This makes weak-linking pretty hard to use these days. If you are in control of the weak-linked framework, the current advice is to use __attribute__((weak_import)) on its exported functions. Naively I'd recommend only doing so in cases where the library is indeed weak-linked and avoiding the attribute being present in normal cases, however I don't know for sure that it will make the code any worse if always present. Caveat programmor. This email sent to eric.gouriou(a)pobox.com This email sent to site_archiver(a)lists.apple.com

1 0

Weakly-Linked Symbols
by Dave Keck 29 Oct '08

29 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:mime-version:content-type:content-transfer-encoding :content-disposition:x-google-sender-auth; bh=BwOFEN3mskDxg9NEKUPRhJutJfXqsxqCv30f/0y1bA8=; b=bvZXbRur7NZ2iE/bJF+nA/6zf+D7Vey4blaD8Eye2LflqBHlf+sCYW/+ol1EfIIFBX m/4kGPwxgV1tb0hKUokDPeqQtotIcNwpBUu2x563fINcPH5/4z8zmZGhrxdEgDAVScUj qCHiZuVCj8fORXOGiZ3hVHnzahpUMLnht9NVE= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition:x-google-sender-auth; b=G1UGGWprJWIoq1PuYskFlYo0/QRduTQtdzgz/jSuBnFTVXzOD6yqx2iLZYWjDvFDQE PciQ4TZ1rJNcLja49Fy11RPm7Ycds7SChSo37WM0TiFUSjQF0lsDdJk2bSKQFgV4RaoC C8ggGl/7ueHV7xnyi/U/FKktGFzK7bxf7IXkE= Hey everyone, This is the most appropriate list I could find for this question pertaining to building weakly-linked libraries and frameworks. Here's a quote from http://developer.apple.com/documentation/MacOSX/Conceptual/BPFrameworks/Con… "Note: When checking for the existence of a symbol, you must explicitly compare it to NULL or nil in your code. You cannot use the negation operator ( ! ) to negate the address of the symbol." I was simply wondering why this is - what's different between this: if ( !mySymbol ) and this: if ( mySymbol == NULL ) to check whether the symbol exists or not? My understanding of C seems to suggest that comparing something with NULL would be precisely the same thing as comparing it with 0 (overlooking the (void *) cast). Thanks for any insight! David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Attack of the itchy security-minded thread stealer! (Was: Re: setuid for priv sockets?)
by Brian Mastenbrook 28 Oct '08

28 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 27, 2008, at 11:46 PM, Jordan K. Hubbard wrote: That would explain why I'm so hot and bothered :-) Sure. -- Brian Mastenbrook brian(a)mastenbrook.net http://brian.mastenbrook.net/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Well, I also think you are taking a couple of threads of disagreement and weaving an entire sweater out of them here. It looks itchy. I think Apple's most recent efforts in sandboxing, code signing and verified downloads speak very much to the contrary, to say nothing of the security hardening work in many other areas. In what way is sandboxing meaningfully used in the operating system? If you're using Safari, any web page can view and upload any file your user has permissions to view. (rdar://6069307, which is over three months old, is P1, and is still parked in somebody's queue). I am also pretty sure that this would still apply to users of certain unreleased operating systems which have been made available to users outside Apple through developer programs. This class of vulnerability is to the best of my knowledge not possible in IE7 on Vista, because the browser really is sandboxed. I can't speak to how well OS X's sandboxing works if it is actually used. My general impression of sandboxing at the system call level is that it's a bit like playing Battleship (getpid! geteuid! vfork! execve! Darn, you sunk my vulnerability), but maybe it does work better than I expect. There is a lot more than "dumb luck" keeping malware off the platform, though, of course, it still remains the case that any substantially determined user can download and run any number of things, up to and including running them with admin privs. If, in other words, a user is determined to practice the computing equivalent of hanging out in Bangkok's red light district, they're going to catch something eventually and there's not a whole lot we can do about that without closing the system up so tightly that users who don't make a practice of grabbing random software from untrusted sources and running it will start grabbing the torches and the pitchforks in order to march down here to teach us a thing or two about practical security. Deliberately downloading untrusted software is not the only way that untrusted software can get its hands on my user account. If something manages to get in the front door (the browser), the battle is *not* lost, and it certainly can be fought a lot harder than it's being fought right now. Of course, you really don't want anything to get in the front door, because having access to all of my documents is bad enough. Getting root is even worse because it can turn a trojan into a virus. It's a balancing act involving the intersection of people and computers, Brian, not something that conveniently reduces to an engineering problem you can just throw money at until it goes away. And I really don't want anything that would annoy the users - quite the contrary, I want the users *not* to become inured to putting in their admin account username and password to every dialog box that asks for it. Twice this year I have submitted security bugs which I have stumbled across that have allowed easy execution of arbitrary shell scripts from Safari without user interaction. I wouldn't mind having the radar #s, so I can look at these as well. rdar://5652640 revisits an old problem in Terminal's URL handlers that allows easy arbitrary shell script execution from Safari rdar://5737359 revisits an old problem in Help's URL handlers, which allows execution of a number of AppleScript files that are shipped with the system rdar://5737366 covers a file type that executes a shell script when opened but was not marked as quarantined, which could be trivially combined with the previous vulnerability to run shell scripts from an arbitrary web page Once again, I'd like to stress that you do not need to be practicing "the computing equivalent of hanging out in Bangkok's red light district" to be affected by these issues. There are a million ways that a careful user can still run across a malicious web page, from SQL injection errors on ill-designed web sites to the possibility of an infected user on the (W)LAN acting as a rogue DHCP server and handing out IPs with a default route that goes right to their portal of doom. With these issues alone, a Leopard Safari user who installed 10.5.0 on October 27th, 2007 was vulnerable until March 19, 2008 to having malware installed on his or her computer without any user action other than visiting a malicious web page. Combined with the widely- publicized ARDAgent escalation of privileges vulnerability, this means that the operating system was vulnerable to a virus of the form I described in my previous email during that entire time as well. Don't take my word for it - grab a 10.5.0 installation disc and try it yourself if you'd like. I will never, ever assume that the black hats are not as smart or as well-informed as I am. If I can see this and imagine a world of malicious possibilities, I'm sure the evil people of the world can too. I also will not assume that if I could easily stumble across a few vulnerabilities that allow execution of arbitrary code from the browser that these are the last few such vulnerabilities, especially when they happen to be slight variants of things that were already exposed and fixed back in the Panther area. That's why I said that it's only dumb luck keeping malware off the platform at this point. For five months the system was wide open and nobody (to the best of my knowledge) exploited it. It's a bit like coming home and finding out you left the front door unlocked. It's great that nobody got in, but don't draw any conclusions from that. I'm not saying there are "no security bugs in the system" here by any means, but our past interaction also suggests that you tend to see a lot of "you need privilege X to do job Y" scenarios as architectural flaws, so much so that it almost seems like simply disconnecting your computer from the network (or AC power) would be the only way to reach the level of security nirvana you're seeking. There's a lot of ground in between where we are now and the unplugged- computer scenario. I would be quite a lot happier if the browser was reasonably secure and users weren't asked at least every few weeks to put their administrative credentials in a pop-up box that could be very easily hijacked by any infestation that was previously confined to their user account. If I see architectural problems, it's because I see many problems. Maybe these are all true singletons and there's no architectural solution to these problems. That wouldn't be my default assumption, but I could easily be wrong. I'm sure you don't actually feel that way, so clearly, we're somehow failing to communicate on some pretty fundamental level here and I'm not sure why. Many of the benefits that the launchd + AuthorizationServices approach seems to provide are applicable in a large, multi-user environment where restricting the access of whole user accounts to certain rights is the goal. My focus is squarely on the users who have taken home their new Mac from the Apple store, followed the setup assistant, and now have one user account with administrative privileges. In this scenario, I really still don't understand how what Apple is doing will decrease the likeliness of the type of drive-by malware that is prevalent on Windows becoming common on OS X as well. On the contrary, I see a predictable way for these programs to gain root by silently hijacking the very API that's supposed to control access to root privileges. Two times in as many months I've had to help close relatives whose Windows XP systems were infected by this kind of malware after they clicked on a popup. The scary thing is that for the first five months of Leopard's life, it wasn't even necessary to click. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Dynamic library in C++
by Rakesh Singhal 28 Oct '08

28 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=xYizkbrH84/HDLk5EhPNE9rVbOJf7ArXLEunYLlKIwE=; b=cb1AN9w6ZuyXgZHhJogmJ44xPkcEuuA4fReKPnvLzl1Ff5VFMEFjzEVqsMAausZxw5 Ro0Vw+IUM375t8OcjY1GYDHN74ps+8Z52qsAbKG9p8E/lS4g/rJBZcySn6j6pqlXyDeJ URp/8VfAPA0ZrAHBAbWHrTVtjmhsA8gRtSuXA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=qLph2c6XhDLU5a+mZiEMNOEx0QFXByN/8k67yXdF7xQJP9xDEoZKKE/f0o7Cok5Gqk HyCamukDxz2uEUXoPRKsxHKNRBFLSIJPjwJmhQd2BTUx5/HklJmFcu7gdLrVwGxuJgJF 0T4FUBp3vUbGzAYGW2LTl9HAXwPPKclsfYs/g= Hi Jean Thanks. I have to support to 10.4 and 10.5 on both ppc and intel. Currently, I am using xcode 2.1. I have to write it to provide the wrapper functions on POSIX APIs for serial ports. I think, I am on right track. Thanks and regards rksinghal On 10/28/08, Jean-Daniel Dupas <devlists(a)shadowlab.org> wrote: > > Le 28 oct. 08 à 10:28, Rakesh Singhal a écrit : > >> Hi all >> >> I have to write a dynamic library to communicate with serial ports >> using the system APIs (POSIX APIs) in C++. Mac OS provieds the >> following types of dynamic libraries. >> >> 1. BSD Dynamic Library >> 2. Carbon Dynamic Library >> 3. Cocoa Dynamic Library >> >> Which one would be suitable for this purpose. >> >> I think I will have to write BSD dynamic library. Kindly suggest me. >> >> Thanks in advance. >> >> Regards > > They are all equivalent (and produce the same kind of binary). > The only difference between these templates is the set of default > libraries/frameworks include in the project. > > In Xcode 3, you have other kind of dynamic library templates, and > particulary C++ dynamic library. I will recommand that for you. > If you don't have this template, just create a BSD dynamic library > project and add the libstdc++ to your project. > > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Dynamic library in C++
by Jean-Daniel Dupas 28 Oct '08

28 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Le 28 oct. 08 à 10:28, Rakesh Singhal a écrit : Hi all I have to write a dynamic library to communicate with serial ports using the system APIs (POSIX APIs) in C++. Mac OS provieds the following types of dynamic libraries. 1. BSD Dynamic Library 2. Carbon Dynamic Library 3. Cocoa Dynamic Library Which one would be suitable for this purpose. I think I will have to write BSD dynamic library. Kindly suggest me. Thanks in advance. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Regards They are all equivalent (and produce the same kind of binary). The only difference between these templates is the set of default libraries/frameworks include in the project. In Xcode 3, you have other kind of dynamic library templates, and particulary C++ dynamic library. I will recommand that for you. If you don't have this template, just create a BSD dynamic library project and add the libstdc++ to your project. This email sent to site_archiver(a)lists.apple.com

1 0

Dynamic library in C++
by Rakesh Singhal 28 Oct '08

28 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=JTz+NBmxq1CgBn3LW6wy2cInUWHVIpli53zBVa3SdQE=; b=qzz/gmP/hBJjtYO8H+WvW5kQfKEccG7FJyuZv8J5FFBulvLMgh9Kih0v+LV1s9Ymmd NNgGlAmnpjThmls541dnlJrU43QotbqrZzvnQDj9YWcqckaGCG+HDXRSB+V88mB8iVwq nBDAAEFXNdwvJ2ZojGmFCCBuiq0/FIzkKyqKg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=Rfos42IiGfftDR+4Rb+M9bEqa1TDLNxyTSHfC1Mq2LITwgKukFOTbz3z7tbTeFlikC g/PWOTe6A2IGB8drs7awGKbb2IgxFCnpJEXp+BQA48k3xdJFqpYYYc1siSC09dtKc5re OTyNvKEohpnAiieMA5Rc0r8q5TKYp61N0iaag= Hi all I have to write a dynamic library to communicate with serial ports using the system APIs (POSIX APIs) in C++. Mac OS provieds the following types of dynamic libraries. 1. BSD Dynamic Library 2. Carbon Dynamic Library 3. Cocoa Dynamic Library Which one would be suitable for this purpose. I think I will have to write BSD dynamic library. Kindly suggest me. Thanks in advance. Regards _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: setuid for priv sockets?
by Jordan K. Hubbard 28 Oct '08

28 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0