November 2008 - Darwin-dev - lists.apple.com

Re: Process Termination Detection
by Terry Lambert 15 Nov '08

15 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry The two solutions I have found so far are as follows. Solution 1: API: Posix Solution 2: API: mach _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… task_for_pid() does not behave as you describe; it will also work if you have equivalent credentials. This sounds like an "adjacent square" security attack, since you don't have normal task_for_pid() privileges by virtue of credential equivalence, and you don't have escalated monitoring or debugging privileges, either of which are required for your program to have legitimate rights to the information it wants. In general, there are not really any non-polled methods that do not require some form of privilege or equivalence of identity to get this information. This includes but is not limited to: - the process consents to being monitored and actively participates by establishing an IPC channel for which disconnect notifications will be sent to the monitoring program - the system consents to the monitoring because of privilege escalation by the monitoring program, or because of credential equivalence with the monitored program combined with constrained capabilities of the monitor API - standards compliance requires the ability to obtain such information (which is why kill-polling and polled parseing "ps" output would work), despite security considerations to the contrary There is, of course, always opportunistic monitoring, but that takes a little more detailed knowledge of the programs behaviour: - the program itself has voluntary "tells" which an be used as a covert monitoring method... e.g. It deletes a publically visible data file on exit, it keeps a publically visible file open until it is resource tracked closed, it logs to a publically visible log file that it is exiting, it has a known rendezvous such as a posix shared memory path, a system V IPC ID, etc.. In general, utilizing many, but not all, of these methods will also require polling. Maybe you can tell us a little bit more about the program you are trying to attack, and why knowing that it has exitted will facilitate your attack, and how narrow a time window you believe you have before the attack would fail, and we could help you narrow things down. On Nov 14, 2008, at 2:11 PM, Brian McKinnon <brian.mckinnon(a)gmail.com> wrote: I am trying to find the best solution to the following problem. I would like to have process A be able to determine when process B has terminated. Process B does not necessarily have to be a child of process A. Any solutions in the mach, POSIX, BSD, Carbon or Cocoa layers would be considered. Poll using kill( pid, 0 ) and wait for an ESRCH error indicating that there is no process with the id 'pid'. This solution is not good because it requires frequent poling for the life of process B which may be long lived. It has the benefit that no special privileges are needed to execute it. Use task_for_pid( myTask, pid, &task ) to get a port on process B. Use mach_port_request_notification( myTask, task, MACH_NOTIFY_DEAD_NAME, 1, port, MACH_MSG_TYPE_MAKE_SEND_ONCE, &lastPort) to register a notification on the mach port 'port' when the mach port 'task' becomes a dead name. The drawbacks to this solution are that process A needs to be running as root, be in the group procmod or be digitally signed. It has the benefit that no polling is required. Are there any other solutions to this on Darwin? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Process Termination Detection
by Philip Aker 15 Nov '08

15 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On 2008-11-14, at 14:11:16, Brian McKinnon wrote: The two solutions I have found so far are as follows. Solution 1: API: Posix Solution 2: API: mach kqueue with EVFILT_PROC and NOTE_EXIT might be a possibility. Philip Aker echo astwta@lvpc.dslh@nl | tr a-z@. p-za-o.@ Democracy: Two wolves and a sheep voting on lunch. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I am trying to find the best solution to the following problem. I would like to have process A be able to determine when process B has terminated. Process B does not necessarily have to be a child of process A. Any solutions in the mach, POSIX, BSD, Carbon or Cocoa layers would be considered. Poll using kill( pid, 0 ) and wait for an ESRCH error indicating that there is no process with the id 'pid'. This solution is not good because it requires frequent poling for the life of process B which may be long lived. It has the benefit that no special privileges are needed to execute it. Use task_for_pid( myTask, pid, &task ) to get a port on process B. Use mach_port_request_notification( myTask, task, MACH_NOTIFY_DEAD_NAME, 1, port, MACH_MSG_TYPE_MAKE_SEND_ONCE, &lastPort) to register a notification on the mach port 'port' when the mach port 'task' becomes a dead name. The drawbacks to this solution are that process A needs to be running as root, be in the group procmod or be digitally signed. It has the benefit that no polling is required. Are there any other solutions to this on Darwin? This email sent to site_archiver(a)lists.apple.com

1 0

Re: File descriptors problem
by Justin C. Walker 15 Nov '08

15 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Nov 14, 2008, at 14:37 , Tommy Nordgren wrote: HTH Justin -- Justin C. Walker, Curmudgeon-At-Large, Director Institute for the Enhancement of the Director's Income -------- The path of least resistance: it's not just for electricity any more. -------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Is it possible, to via some low level API, set up a file descriptor so that any data written to it, will be echoed to 2 or more other file descriptors? I want to redirect the output of NSLog, to my own logfile, while keeping all current destinations of log messages. The only way I've found so far is to call the following function: That's about the easiest way I can think of (which doesn't eliminate the possibility of easier or more effective approaches). The problem is that "write()" just takes one file descriptor, and that's the choke point for output. You could write an "intercept" function that takes control when write() is called, uses its args to write to other fd's (that have been set up earlier) and then passes control to the real "write()". That's a lot of work, though. This email sent to site_archiver(a)lists.apple.com

1 0

File descriptors problem
by Tommy Nordgren 14 Nov '08

14 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Any help would be appreciated Tommy Nordgren tommy.nordgren(a)comhem.se _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Is it possible, to via some low level API, set up a file descriptor so that any data written to it, will be echoed to 2 or more other file descriptors? I want to redirect the output of NSLog, to my own logfile, while keeping all current destinations of log messages. The only way I've found so far is to call the following function: int setup_logging() { int pipes[2]; int result = pipe(pipes); int f = fork(); if (f) { /* parent */ dup2(pipes[1],2); close(pipes[1]); close(pipes[0]); return 0; } else { dup2(pipes[0],0); close(pipes[0]); close(pipes[1]); execlp("/usr/bin/tee","tee","/Users/emac/Desktop/log",0); fprintf(stdout,"failed\n"); exit(1); } } ----------------------------------- See the amazing new SF reel: Invasion of the man eating cucumbers from outer space. On congratulations for a fantastic parody, the producer replies : "What parody?" This email sent to site_archiver(a)lists.apple.com

1 0

Process Termination Detection
by Brian McKinnon 14 Nov '08

14 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type; bh=l5lETjvEKGa/7N2noLcaigfnh2CaXbLJHBDoohHhM2Y=; b=Tj+BNEyIlB7sr4VgB4Lk7DYut9q+CvqIN+jXHEXnzRiMD3Olh33KkCYjqAewB/13xQ imjznUxug8aOsGmLTTKVR22GfA+fQWpkIjOZVHlhTcNXhJwiCZ3XK7uUCQgRDO8z7+7r ETAWoEr2rk3M7Ygsf35L+9HedHATe2dYU5QXA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=Ubn/ATYRqDFZVWwyBHBtJhRsMAnnu3DuD9xIqswNNc6031uGiuS0/JsSwUxyrmwMjR wN3gXV58jPJcqBf2WterbPrzBdZk+TbFHNGThpHr1qV+otKnED6nrLLhYy2MKLosM+ji /P4De+sLdY14jEqgPFcUtnxtPwZPV8+ARBOKA= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

getrusage not returning memory information
by Jim Brandt 14 Nov '08

14 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17) Gecko/20080914 Thunderbird/2.0.0.17 Mnenhy/0.7.5.666 Hello, I've been trying to trace back an issue with the perl module BSD::Resource not displaying memory information for processes. I believe I've traced it back to the getrusage call provided via sys/resource.h. I've got a simple sample program (below) that shows values for time and memory use on a FreeBSD system, but on Mac OS X 10.5, I get the two time values and zeros for the memory values. Does anyone have any ideas why the values aren't coming back? Should I file a bug report? Is there a better way to get memory usage information in a program? Thanks for any feedback. Jim #include <stdio.h> #include <sys/resource.h> main() { struct rusage ru; printf("starting\n"); int i; int a[1000000]; for (i = 0; i <= 1000000; i = i + 1){ if ( i % 100 == 0 ) printf("%d",i); a[i] = i; } int c; c = 1; printf("\n\nGive me an integer to keep running:"); while ( (scanf("%d", &c)) == 1 ){ getrusage(0, &ru); printf("\n\n"); printf("%d\n",ru.ru_utime.tv_usec); printf("%d\n",ru.ru_stime.tv_usec); printf("%ld\n",ru.ru_maxrss); printf("%ld\n",ru.ru_ixrss); printf("%ld\n",ru.ru_idrss); printf("\n\nGive me an integer to keep running:"); } printf("done\n"); return 0; } -- Jim Brandt Administrative Computing Services University at Buffalo _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: CF
by Aladin 14 Nov '08

14 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender :to:subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references :x-google-sender-auth; bh=od97Uh5A2I4EnXx8LbJbK78ibt3fhKylyLY3aStYMVk=; b=YLjMEzvjuR/IEkdSv0tFMNU8CL54WVT9pgVhx962M1ac/yaK6gL9Y2h34mhhB3ayzk Cy6o6Ym0ouOUDqiN4EyNMsI2iWI+if8+HdIsSGKqk9QibZQMZfo22zBBTwjcM0Jwn0I9 BYTWca7egFVGaohcHj6MMezYvM364oSZPyR/U= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=N4hhfHuhIopGfaNr70w6293xlqg4jbZP3nQ+na33K+fBiP5oFGw4BitnjIFkDw1r6F jsxwbJhuVW0k6vtnMtPoKMkCxiK4XHw6tkT5HX/aPMXmo5FWk2Jtz/ZBME0qFZT1In7b 2/QoBbpMPCSXw8xqkc3aHlpr89KMDbBFLM4Ck= I didn't find CF-196.4 but the earliest I found is http://darwin.monkeyvoodoo.net/files/fixes/CoreFoundation-262-1151.tar.gz On Mon, Nov 10, 2008 at 8:43 PM, Benjamin Huntsman <BHuntsman(a)mail2.cu-portland.edu> wrote: > Does anyone know where to obtain CF-196.4 anymore? > I thought it used to be available, but the earliest I can find is CF-299. > > Thanks in advance! > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-dev/aladin%40puredarwin.org > > This email sent to aladin(a)puredarwin.org > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: lint does not compile
by Kevin Van Vechten 13 Nov '08

13 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com <http://clang.llvm.org/StaticAnalysis.html> - Kevin On Nov 12, 2008, at 2:27 PM, Steve Checkoway wrote: If you are set on using lint, you may be interested in splint: http://splint.org. I think I got it compiling in the last two years or so, and it hasn't been changing much. Last time I looked at splint, it didn't even support c99. Unless you do silly things like declare all of your variables at the beginning of the block in which they're declared, splint is pretty useless as far as I could tell. -- Steve Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Also, the LLVM/Clang Static Analyzer is progressing nicely and can probably analyze a reasonably large amount of BSD code at this point; and I'm sure the team would be appreciative of any pointers to code that it can't successfully parse. On Wed, Nov 12, 2008 at 01:14:51PM -0800, Nathan Herring wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Re: autozone Release
by Jordan K. Hubbard 12 Nov '08

12 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Nov 12, 2008, at 7:48 AM, Benjamin Huntsman wrote: Interesting project! I'm curious about two things, though: 1. Why Apple chose to implement it in C++ - Jordan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… It had to be written in something. Some people like C++, the fact that I do not number myself in this camp notwithstanding, and it is an Apple support development language, so... In all fairness, it should also be pointed out that the ObjectiveC runtime costs (messaging and so on) are generally not a problem in 99.9% of all cases, except for that critical 0.1% case where you're manipulating things at a very low level and need to control your execution environment very carefully. I suspect that autozone is one such project. 2. Why they released it under the Apache license, instead of APSL To encourage wider adoption. When Apple releases something of their own under the BSD or Apache licenses, that is generally the rationale behind it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: lint does not compile
by Steve Checkoway 12 Nov '08

12 Nov '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mutt/1.5.17+20080114 (2008-01-14) On Wed, Nov 12, 2008 at 01:14:51PM -0800, Nathan Herring wrote: > If you are set on using lint, you may be interested in splint: > http://splint.org. I think I got it compiling in the last two years > or so, and it hasn't been changing much. Last time I looked at splint, it didn't even support c99. Unless you do silly things like declare all of your variables at the beginning of the block in which they're declared, splint is pretty useless as far as I could tell. -- Steve Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0