October 2009 - Darwin-dev - lists.apple.com

Re: How to manually register a symbol address in dyld?
by Jean-Daniel Dupas 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Le 14 oct. 2009 à 15:56, Stéphane Corthésy a écrit : Hello, On Oct 13, 2009, at 4:30 PM, Peter O'Gorman wrote: Hello, I don't know what it is. I saw no mention on 'alias' in dyld code. Wouldn't work, like with weak symbols. // In header file. extern void (*my_renamed_function)(void *arrgs); // somewhere at initialization if (10.5) my_renamed_function = my_original_function; else my_renamed_function = another_function; ------------- And where you need to use it: my_renamed_function(args); -- Jean-Daniel _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. So, is there a way to do that, and how? Why do you need to do this? There are very likely alternative ways of doing what you need e.g. weak undefined external symbols, That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. symbol aliases, using dlsym() to check at runtime what symbols are available etc etc. Please provide more details about the problem you're trying to solve. I will, once I know how to do it ;-) Instead of dealing with dylib issue, isn't it possible to create a function pointer that you invoke where you need, and set the function value at initialization ? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Carbon framework availability
by Mo McRoberts 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Wed, Oct 14, 2009 at 14:48, rohan a <info1686(a)gmail.com> wrote: > Hello All, > > For a particular Mac OS X binary, I need the carbon framework. There > is no problem with the linking with the Carbon framework. > I use -framework Carbon > > Now, when I do > #otool -L a.out > I see this > /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon > (compatibility version 2.0.0, current version 128.0.0) > . > . > . > > Now my doubt here is that, is the above library available by default > with every Mac machine ?I want to be sure before I allow other users > to use it. Yes. That’s why it’s in /System/Library and documented—in detail—on http://developer.apple.com/ Carbon in some form or another has been available since before Mac OS X was first released. M. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Stéphane Corthésy 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hello, On Oct 13, 2009, at 4:30 PM, Peter O'Gorman wrote: Hello, I don't know what it is. I saw no mention on 'alias' in dyld code. Wouldn't work, like with weak symbols. I will, once I know how to do it ;-) Thanks, Stéphane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. So, is there a way to do that, and how? Why do you need to do this? There are very likely alternative ways of doing what you need e.g. weak undefined external symbols, That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. symbol aliases, using dlsym() to check at runtime what symbols are available etc etc. Please provide more details about the problem you're trying to solve. This email sent to site_archiver(a)lists.apple.com

1 0

Carbon framework availability
by rohan a 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=W46tdLE5l2ZWv9ecLHXTLw4/U/hKqsBCzSH5VCJeQSs=; b=Wgle5kq7Mm2yT5IBtxMIgGuwmf0nLgXL8genIYv+MXWFT+KvONgObA+omzHbkLnJg8 P6widwv4JrmewleQsF+sG7vDARZ4VO1ovFUArkWr9TEKw5hllxWX0xWr4Z2Uk3oxGLKl gPeRtwtsDJNtvwBdw5Z8j/WVqlPTA+5lbrkhk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=u5le9xQB+r4eUzbrtSDePKf/lSd8Wz7l0iEqVaOXb1m/fAg78LQGCm2/wpXUt2J1j7 wTJrUITXpGgePTauYlSC3G2zNzoNmiXlxvzEYilmgalifYABq9wb7ylVcsqM+taawUkV Qd9qKDxXtJdp45c61tMo2WRZCH9LQef8phKoE= Hello All, For a particular Mac OS X binary, I need the carbon framework. There is no problem with the linking with the Carbon framework. I use -framework Carbon Now, when I do #otool -L a.out I see this /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon (compatibility version 2.0.0, current version 128.0.0) . . . Now my doubt here is that, is the above library available by default with every Mac machine ?I want to be sure before I allow other users to use it. Thanks in advance... _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Terry Lambert 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 12, 2009, at 12:45 PM, Rustam Muginov wrote: Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. rdar://problem/7244262 Summary: When a KAUTH_SCOPE_FILEOP listener receives a KAUTH_FILEOP_EXEC notification, there is no indication as to which process has loaded the indicated executable. Calling proc_self() or proc_selfpid() sometimes returns the loading process and sometimes returns the parent of the process. (Unsure if there are any cases in which it returns neither.) Suggested enhancement: When exec_activate_image() calls kauth_authorize_fileop() to broadcast the KAUTH_FILEOP_EXEC notification, it passes zero as the unused final argument to kauth_authorize_fileop(). At that point, it also has information from which the desired BSD process could be derived, so it could pass the proc_t pointer or the pid value for the process as that final argument. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 13, 2009, at 9:40 PM, Ryan McGann <rmcgann(a)mac.com> wrote: On Oct 13, 2009, at 12:08 PM, darwin-dev-request(a)lists.apple.com wrote: P.S. I should have mentioned that /dev/auditpipe is not available on 10.5 but currently only 10.6. Also, 10.5 doesn't have audit events available for system calls like posix_spawn(). It seems that posix_spawn() is used a lot by Mac OS X. This is tagential, but still related, to another bug that we have found, and already reported. It was present in 10.5 but not many people used posix_spawn, but Apple uses it a lot more internally in 10.6. We tried to work around it, but it's proven more difficult than originally thought. Basically, we track all fileop_exec notifications to internally watch processes being launched, but when posix_spawn is used, the code path is slightly different (see xnu). For posix_spawn, the fileop_exec notification is "posted" inside the context of the parent process, not the child, making it impossible to tell what is the new process ID. Not the same as the original problem stated here, but if the OP wants to use a kernel extension, be warned that kauth_fileop_exec won't work correctly in Snow Leopard either. It works correctly, just not in the way you'd want it to work if your intent was to inject code into each newly created process before it got up and running. I am personally not a big fan of code injection of this type, as it is inexact with regard to scheduling, at best. Better that you use the spawn extensions yourself to start the child in a suspended state with access to its task port directly. There was never any guarantee that the notification for a posix_spawn would happen in the context of the new process. Unlike exec, which replaces the currently running process image, and thus current_proc() returns a pointer to the process doing the replacing at the time if the notification, unless you set the 'exec' flag in the spawn case, the thread which is running at the time the spawn completes is the parent process, not the child. The first time the child runs is actually after we call thread_resume() on it and it gets sceduled into user space, specifically into dyld, and we do not have an opportunity to actually run any code in kernel space in the context of the new process until it starts making system calls - which is way too late to be effective. We can (and do) hack the return value for current_proc() in the dtrace probe point case, both for posix_spawn and for vfork/exec cases, but NOT for the notification site, and for good reason; were you to attempt instead current_task() or current_thread() rather than current_proc(), you'd get the parents information instead. The dtrace probe points are controllable code, so when we go through current_proc (), we can know things will work; arbitrary KEXTs aren't controllable by us so having a partially hooked up set of pointers is of limited value if it makes it easy to make mistakes. We have one extra pointer, and we have conflicting requests for it use, including one that predates your request here. We have not decided on a course of action at this time. We are also limited on our binary compatibility guarantees to not making a change in this area in minor releases; because of this you'd have to check that the value was non-zero before using it, and if not, fall back to using a heuristic, which would mean carrying around both sets of code, so it's probably better to just carry around the heuristic than introducing a variant code path in an update, when your hueristic is going to have to work in case you are installed on a pre- update system. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Ryan McGann 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 13, 2009, at 12:08 PM, darwin-dev-request(a)lists.apple.com wrote: On Oct 12, 2009, at 12:45 PM, Rustam Muginov wrote: Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. P.S. I should have mentioned that /dev/auditpipe is not available on 10.5 but currently only 10.6. Also, 10.5 doesn't have audit events available for system calls like posix_spawn(). It seems that posix_spawn() is used a lot by Mac OS X. rdar://problem/7244262 Summary: When a KAUTH_SCOPE_FILEOP listener receives a KAUTH_FILEOP_EXEC notification, there is no indication as to which process has loaded the indicated executable. Calling proc_self() or proc_selfpid() sometimes returns the loading process and sometimes returns the parent of the process. (Unsure if there are any cases in which it returns neither.) Suggested enhancement: When exec_activate_image() calls kauth_authorize_fileop() to broadcast the KAUTH_FILEOP_EXEC notification, it passes zero as the unused final argument to kauth_authorize_fileop(). At that point, it also has information from which the desired BSD process could be derived, so it could pass the proc_t pointer or the pid value for the process as that final argument. Ryan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This is tagential, but still related, to another bug that we have found, and already reported. It was present in 10.5 but not many people used posix_spawn, but Apple uses it a lot more internally in 10.6. We tried to work around it, but it's proven more difficult than originally thought. Basically, we track all fileop_exec notifications to internally watch processes being launched, but when posix_spawn is used, the code path is slightly different (see xnu). For posix_spawn, the fileop_exec notification is "posted" inside the context of the parent process, not the child, making it impossible to tell what is the new process ID. Not the same as the original problem stated here, but if the OP wants to use a kernel extension, be warned that kauth_fileop_exec won't work correctly in Snow Leopard either. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Stacey Son 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com FYI Rustam: http://www.trustedbsd.org/mac.html (TrustedBSD website) and various white papers: http://www.trustedbsd.org/trustedbsd-usenix2003freenix.pdf http://www.trustedbsd.org/trustedbsd-discex3.pdf -stacey. On Oct 13, 2009, at 12:11 PM, Terry Lambert wrote: -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… For more information about MACF (Mandatory Access Control Framework) see the following: http://www.freebsd.org/doc/en/books/handbook/mac.html (FreeBSD's MAC document. The FreeBSD and Mac OS X implementations are very similar.) MACF is not KPI at present. You can use it if you are willing to link against the entire kernel and suffer changes on point releases until it's baked. The kauth exec stuff allows notification but not interception, though you could cheat at lookup, which has to be done to exec. On Oct 13, 2009, at 9:39 AM, Rustam Muginov <rmuginov(a)gmail.com> wrote: Thank you for your advice, Terry. I had studied Kauth approach at the times of 10.4. I had got an impression that the only intercept possible is file access at vnode scope, and it only intercepts file open/read but not execute. Am i wrong in this assumption, and kauth does allow to intercept process execution? Also, could you please tell a little more about MACF? This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Terry Lambert 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry Also, could you please tell a little more about MACF? On Oct 12, 2009, at 10:40 PM, Terry Lambert wrote: Yes. -- Terry Thank you for the hint, Terry. But isnt' it a polling-like behavior? On Oct 12, 2009, at 1:57 AM, Terry Lambert wrote: There's popen of ps, which is much preferred to sysctl. -- Terry On Oct 11, 2009, at 1:01 PM, Dave Keck <dave(a)docdave.com> wrote: kevents are perfectly capable of monitoring another, unrelated process. It's become quite a hobby of mine, actually. :) -- Sincerely, Rustam Muginov _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… MACF is not KPI at present. You can use it if you are willing to link against the entire kernel and suffer changes on point releases until it's baked. The kauth exec stuff allows notification but not interception, though you could cheat at lookup, which has to be done to exec. On Oct 13, 2009, at 9:39 AM, Rustam Muginov <rmuginov(a)gmail.com> wrote: Thank you for your advice, Terry. I had studied Kauth approach at the times of 10.4. I had got an impression that the only intercept possible is file access at vnode scope, and it only intercepts file open/read but not execute. Am i wrong in this assumption, and kauth does allow to intercept process execution? The best answer is "don't need to do that in the first place". Other than a KEXT hooking kauth or MACF, you are not going to successfully interpose yourself in the creation of a new process. Even then, what you can do is intentionally limited. On Oct 12, 2009, at 10:50 AM, Rustam Muginov <rmuginov(a)gmail.com> wrote: Other than that, we're not going to alert you on new process creation other than by return code if you are the creator, and at some point we might even take steps to make it hard for you to do so, like randomizing pids. You cannot watch for all processes, only processes you created. After you fork, you can add a kqueue to watch for the new process' death, in lieu of waitpid() or a SIGCHLD signal. You cannot however sit there, watching for any random process' death. Mac OS X has no such mechanism, AFAIK. As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) Of course you could always iterate over the process list checking each process' parent PID... there's probably a better way, though. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Rustam Muginov 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:cc:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=VrN8LEy5ZIZ+u/4AYiQ8XBilCmrgZaeObj4q/w0AmbQ=; b=EJehuaztwB2fWD1u65XEx7BkwsQxKhn5IYij4g3bvdSBPGNVrBQjMKiOlkPo5m5NLF ot5OCi1KIjodvVFqeTKyuzO7cbQtz3LI68AXRszNhaNPw2KqnNkSnAqIPfD9ckGRsj6y 0Itmj6uqjey0YRqq5xvLj1i+Fnf7SRDc/++K4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=cc:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=fBsbuLca0TUozDGlLU8OHgtTgaEFvjYIXXFm97prsJzXH+ivJ5QloO019VybyvwRRP u+9gspQt2qeWTp8JHgXi/ani0UqWKH2MJwMIi81oFM7BFmdiQJPAnZvWOEu4Mjv6pzVn B1BWVzABii4qSJVc+0FgYsX4LgkBzhjHJCZLg= Also, could you please tell a little more about MACF? On Oct 12, 2009, at 10:40 PM, Terry Lambert wrote: Yes. -- Terry Thank you for the hint, Terry. But isnt' it a polling-like behavior? On Oct 12, 2009, at 1:57 AM, Terry Lambert wrote: There's popen of ps, which is much preferred to sysctl. -- Terry On Oct 11, 2009, at 1:01 PM, Dave Keck <dave(a)docdave.com> wrote: kevents are perfectly capable of monitoring another, unrelated process. It's become quite a hobby of mine, actually. :) -- Sincerely, Rustam Muginov _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thank you for your advice, Terry. I had studied Kauth approach at the times of 10.4. I had got an impression that the only intercept possible is file access at vnode scope, and it only intercepts file open/read but not execute. Am i wrong in this assumption, and kauth does allow to intercept process execution? The best answer is "don't need to do that in the first place". Other than a KEXT hooking kauth or MACF, you are not going to successfully interpose yourself in the creation of a new process. Even then, what you can do is intentionally limited. On Oct 12, 2009, at 10:50 AM, Rustam Muginov <rmuginov(a)gmail.com> wrote: Other than that, we're not going to alert you on new process creation other than by return code if you are the creator, and at some point we might even take steps to make it hard for you to do so, like randomizing pids. You cannot watch for all processes, only processes you created. After you fork, you can add a kqueue to watch for the new process' death, in lieu of waitpid() or a SIGCHLD signal. You cannot however sit there, watching for any random process' death. Mac OS X has no such mechanism, AFAIK. As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) Of course you could always iterate over the process list checking each process' parent PID... there's probably a better way, though. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Peter O'Gorman 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.4pre) Gecko/20090922 Fedora/3.0-2.7.b4.fc11 Thunderbird/3.0b4 Hello, For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. Please provide more details about the problem you're trying to solve. Peter -- Peter O'Gorman http://pogma.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: So, is there a way to do that, and how? Why do you need to do this? There are very likely alternative ways of doing what you need e.g. weak undefined external symbols, symbol aliases, using dlsym() to check at runtime what symbols are available etc etc. This email sent to site_archiver(a)lists.apple.com

1 0