October 2008 - Darwin-dev - lists.apple.com

SOL_NDRVPROTO
by Brad Parker 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Organization: Heeltoe Consulting (just *full* of questions today :-) I'm having trouble using ioctl(SOL_NDRVPROTO, NDRV_SETDMXSPE) on an AF_NDRV socket. I'm trying to filter for protocols 0x800 & 0x806, ip and arp. I get an error when I do the NDRV_SETDMXSPE ioctl. If I make the protocol numbers something odd, like 0x801 and 0x802, the ioctl works fine, repeatedly. I set the address family in struct ndrv_protocol_desc to a unique value (in this case 0x11223344). Any idea why? Since non-standard ethernet packet types work, I'd think I'm doing the basics correctly. Seems odd that 0x800 & 0x806 won't work, unless the demux checks and requires them to be unique. I'd rather not use BPF, but I'm wondering if that is the only good solution. I'm running 10.5.5, btw, on an x86. -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: setuid for priv sockets?
by Damien Sorresso 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Is the right thing to make the app setuid root and do seteuid()? This is (currently) a command line application. I suspect I should ultimately add a UI and have it pop up a window asking for authentication... (but I'm trying to avoid a UI for now) Brad, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com On Oct 27, 2008, at 11:11 AM, Brad Parker wrote: If I have a app which wants to open a "privileged" socket (AF_NDRV) for direct ethernet access, We're strongly (and I do mean strongly) trying to move people off of setuid binaries. If it's a command line application, you can just require that the user run it as root or with sudo if performing actions that require access to this privileged port. -- Damien Sorresso BSD Engineering Apple Inc. smime.p7s

1 0

setuid for priv sockets?
by Brad Parker 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Organization: Heeltoe Consulting If I have a app which wants to open a "privileged" socket (AF_NDRV) for direct ethernet access, Is the right thing to make the app setuid root and do seteuid()? This is (currently) a command line application. I suspect I should ultimately add a UI and have it pop up a window asking for authentication... (but I'm trying to avoid a UI for now) -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: sigbus vs sigsegv on mprotect() exeception?
by Dave Zarzycki 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Brad, davez On Oct 27, 2008, at 8:46 AM, Brad Parker wrote: Dereference of null pointers causes SIGBUS because we map an inaccessible page at page zero to prevent an accessible page being mapped there instead. For 64 bit programs, we do the same for the low 4G to catch pointer truncations from things like pointer-int-pointer pig tricks. If you don't like it you can always mmap and munmap a page on top of it to get an SIGSEGV instead. I believe I am mmaping pages and still seeing SIGBUS. specifically, I if mprotect with r+x and then try to write, I get SIGBUS when I expect SIGSEGV. -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/zarzycki%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This is arguably a bug, but probably not worth fixing at this point. In practice, the difference between these two signals is mostly, if not totally historic. Please consider changing the code to catch both signals and handle them identically. Terry Lambert wrote: This email sent to zarzycki(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: sigbus vs sigsegv on mprotect() exeception?
by Brad Parker 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Organization: Heeltoe Consulting Terry Lambert wrote: >Dereference of null pointers causes SIGBUS because we map an >inaccessible page at page zero to prevent an accessible page being >mapped there instead. For 64 bit programs, we do the same for the low >4G to catch pointer truncations from things like pointer-int-pointer >pig tricks. If you don't like it you can always mmap and munmap a >page on top of it to get an SIGSEGV instead. I believe I am mmaping pages and still seeing SIGBUS. specifically, I if mprotect with r+x and then try to write, I get SIGBUS when I expect SIGSEGV. -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: sigbus vs sigsegv on mprotect() exeception?
by Terry Lambert 27 Oct '08

27 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry On Oct 26, 2008, at 4:05 PM, Brad Parker <brad(a)heeltoe.com> wrote: Hi, I'm running mac os 10.5.5 on an x86 cpu. I noticed that mprotect()'d pages throw SIGBUS for violations. My code (which admittedly started on linux) expects SIGSEGV. -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Dereference of null pointers causes SIGBUS because we map an inaccessible page at page zero to prevent an accessible page being mapped there instead. For 64 bit programs, we do the same for the low 4G to catch pointer truncations from things like pointer-int-pointer pig tricks. If you don't like it you can always mmap and munmap a page on top of it to get an SIGSEGV instead. Is there any standard document which covers this behavior? I'm guessing that 99.99% of the world would never notice. any thoughts on this? what does freebsd do? or solaris? just curious. This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

sigbus vs sigsegv on mprotect() exeception?
by Brad Parker 26 Oct '08

26 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Organization: Heeltoe Consulting Hi, I'm running mac os 10.5.5 on an x86 cpu. I noticed that mprotect()'d pages throw SIGBUS for violations. My code (which admittedly started on linux) expects SIGSEGV. Is there any standard document which covers this behavior? I'm guessing that 99.99% of the world would never notice. any thoughts on this? what does freebsd do? or solaris? just curious. -brad _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kernel gettimeofday?
by Terry Lambert 24 Oct '08

24 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com There are time calls, but they are generally in GMT, since unlike gettimeofday(), there's no concept of time zone in the kernel itself. This may be enough for our situation. I've not been able to work out which calls to use. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 24, 2008, at 12:01 PM, Duane Murphy wrote: --- At Thu, 23 Oct 2008 18:00:29 -0700, Terry Lambert wrote: On Oct 23, 2008, at 1:08 PM, Duane Murphy wrote: Is there an equivalent method for getting the current wall clock date and time akin to gettimeofday() from the kernel or IOKit? You need to look at the Mach kernel exports list and search for the word "clock_get_calendar"; there's a number of interfaces. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kernel gettimeofday?
by Duane Murphy 24 Oct '08

24 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com --- At Thu, 23 Oct 2008 18:00:29 -0700, Terry Lambert wrote: >On Oct 23, 2008, at 1:08 PM, Duane Murphy wrote: >> Is there an equivalent method for getting the current wall clock date >> and time akin to gettimeofday() from the kernel or IOKit? > >There are time calls, but they are generally in GMT, since unlike >gettimeofday(), there's no concept of time zone in the kernel itself. This may be enough for our situation. I've not been able to work out which calls to use. >Most of these calls are pretty expensive. If you are wanting this >data for logging purposes, you should log to a user space program that >attaches the timestamps there. This is not for logging and the calls are not used very often. ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kernel gettimeofday?
by Terry Lambert 24 Oct '08

24 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Is there an equivalent method for getting the current wall clock date and time akin to gettimeofday() from the kernel or IOKit? -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 23, 2008, at 1:08 PM, Duane Murphy wrote: There are time calls, but they are generally in GMT, since unlike gettimeofday(), there's no concept of time zone in the kernel itself. Most of these calls are pretty expensive. If you are wanting this data for logging purposes, you should log to a user space program that attaches the timestamps there. This email sent to site_archiver(a)lists.apple.com

1 0