October 2009 - Darwin-dev - lists.apple.com

How to manually register a symbol address in dyld?
by Stéphane Corthésy 13 Oct '09

13 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hello, So, is there a way to do that, and how? Thanks for your enlightenments, Stéphane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Stacey Son 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 12, 2009, at 12:45 PM, Rustam Muginov wrote: Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. P.S. I should have mentioned that /dev/auditpipe is not available on 10.5 but currently only 10.6. Also, 10.5 doesn't have audit events available for system calls like posix_spawn(). It seems that posix_spawn() is used a lot by Mac OS X. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Stacey Son 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 12, 2009, at 12:45 PM, Rustam Muginov wrote: 'praudit': (see 'man praudit') http://p4db.freebsd.org/depotTreeBrowser.cgi?FSPC=//depot/projects/trustedb… 'bsmtrace': (a simple host-based IDS) http://p4db.freebsd.org/depotTreeBrowser.cgi?FSPC=//depot/projects/trustedb… Best Regards, -stacey. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. I would recommend that you first read the Sun documentation on the BSM format ( see http://docs.sun.com/app/docs/doc/806-1789) The BSM audit format is standard across Solaris, FreeBSD and Mac OS X with some minor differences. You may want to also refer to the TrustedBSD web site and mailing list: http://www.trustedbsd.org/audit.html The only docs i found are the Common Criteria manuals about command- line tools and GUI apps here: http://www.apple.com/support/security/commoncriteria/ As for apple documentation take a look at 'man libbsm' and some of the man pages mentioned under "SEE ALSO". Are where any examples/code snippets available? I do believe i could use the audit facility from inside my appliction, instead of relying on external command-line tools. Should the process dealing with audit run on behalf of root, or it could be a regular user process? To read from /dev/auditpipe your process will need root privileges so you may want to create a monitoring daemon that sends messages with the information you need via some kind of IPC. Please note the "BUGS" section of the auditpipe man page about it dropping records if userland can't read them fast enough. Of course, the queue length/buffer can be increased to reduce this possibility. The event will always be written to the audit trail file. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Terry Lambert 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Yes. -- Terry Thank you for the hint, Terry. But isnt' it a polling-like behavior? On Oct 12, 2009, at 1:57 AM, Terry Lambert wrote: There's popen of ps, which is much preferred to sysctl. -- Terry On Oct 11, 2009, at 1:01 PM, Dave Keck <dave(a)docdave.com> wrote: kevents are perfectly capable of monitoring another, unrelated process. It's become quite a hobby of mine, actually. :) _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… The best answer is "don't need to do that in the first place". Other than a KEXT hooking kauth or MACF, you are not going to successfully interpose yourself in the creation of a new process. Even then, what you can do is intentionally limited. On Oct 12, 2009, at 10:50 AM, Rustam Muginov <rmuginov(a)gmail.com> wrote: Other than that, we're not going to alert you on new process creation other than by return code if you are the creator, and at some point we might even take steps to make it hard for you to do so, like randomizing pids. You cannot watch for all processes, only processes you created. After you fork, you can add a kqueue to watch for the new process' death, in lieu of waitpid() or a SIGCHLD signal. You cannot however sit there, watching for any random process' death. Mac OS X has no such mechanism, AFAIK. As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) Of course you could always iterate over the process list checking each process' parent PID... there's probably a better way, though. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Damien Sorresso 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: Darwin-dev(a)lists.apple.com Thank you for explanation, Damien. How fast the kqueue events are delivered to the subscribed process? As fast as the implementation allows. So again, no guarantees. >From kqueue(2)... -- Damien Sorresso BSD Engineering Apple Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 12, 2009, at 10:48 AM, Rustam Muginov wrote: Is it possible that the watched process would spawn child process, kill it, and then spawn another one before the watching application get notified? Sure. The kernel will deliver events to you as fast as it can, but it doesn't make any guarantees regarding latency. Also keep in mind that the kernel could deliver the event to you with near-zero latency, but you're still responsible for dequeuing it on your end. And the thread responsible for that in your code is at the mercy of the kernel's scheduler. Can the regular-user application watch other users/root processes, or it must run on behalf of root? If a process can normally see another process, it can attach an event to it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Rustam Muginov 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:cc:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=WMUuaE3LQKdiBg1TR0BtrKY1YqQauefVN8EIHbzJZWU=; b=DmJvWP6NfPRKOZSfgjtsAidfs4cCjURJfRJ/KW6AeEbf7Yfv+Y24YPZFqCS3eW1UxF BmtxEza6lGmhMj0vIbGWk2fh4MC7sQqIJqoRPOgSOvOnqaJZKa+KOBrkPDQnMA+2CA/5 5OCqHMoVY8z5Hm91a3e9m5e/lcgViwLf0Q2L4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=cc:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=ReiKSIpdlLrbNVM3och0GvBAijofL/ki1wiGFbC1DIO9XC3byfhmx9mAM12wa5LhTC mO3D89xPAEFE4Yh6SQfj9YVMnBhu97cAscVZ+/sK/HkXpvd5oqtvsCptb7Y71ENJdzhg FeiAdcK5B7uJ2n8AKUW5ANs4GlEbzh/rmalLU= Thank you for the hint, Terry. But isnt' it a polling-like behavior? On Oct 12, 2009, at 1:57 AM, Terry Lambert wrote: There's popen of ps, which is much preferred to sysctl. -- Terry On Oct 11, 2009, at 1:01 PM, Dave Keck <dave(a)docdave.com> wrote: kevents are perfectly capable of monitoring another, unrelated process. It's become quite a hobby of mine, actually. :) _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/rmuginov%40gmail.com -- Sincerely, Rustam Muginov _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Other than that, we're not going to alert you on new process creation other than by return code if you are the creator, and at some point we might even take steps to make it hard for you to do so, like randomizing pids. You cannot watch for all processes, only processes you created. After you fork, you can add a kqueue to watch for the new process' death, in lieu of waitpid() or a SIGCHLD signal. You cannot however sit there, watching for any random process' death. Mac OS X has no such mechanism, AFAIK. As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) Of course you could always iterate over the process list checking each process' parent PID... there's probably a better way, though. This email sent to rmuginov(a)gmail.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Rustam Muginov 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: Darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:cc:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=K/COihIozEwhpL52WrGnD3peO5Z8duPB3McXPjE9KGc=; b=oiG9tr5nhkFGxtk7ZKPPITh9SiGX72VybYF6M0zbRCp6CNoOlm7kEecpQfNLUhB4IG A+vG8NGF3IBkS0FoSUP8hUivCFwHhiOy94BL6xG3vizBBUNLD282ztXGEnoCc9mJI2U8 PpC6T8AEIOpBXK3zTCjM7YwpmNiuEu/KuIUSY= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=cc:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=YLlrVjyPRB5x8GRH1finlcnSZoI6UeeAVYl2qOD1jIlY9WQI+GoJkIMx039gBD4/EP /6NFckvfJTkQtpBhY6s8DJKX4aA0Kg2UXCb6Gjf3rw8bu9BzVo/Cj/FtdVc7W4C2TVx1 fEoUl79VbPClvuSTjmM5qdu1h0CdK/J7reBwA= On Oct 11, 2009, at 11:40 PM, Damien Sorresso wrote: Yes. -- Sincerely, Rustam Muginov _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thank you for explanation, Damien. How fast the kqueue events are delivered to the subscribed process? Is it possible that the watched process would spawn child process, kill it, and then spawn another one before the watching application get notified? Can the regular-user application watch other users/root processes, or it must run on behalf of root? On Oct 11, 2009, at 9:18 AM, Rustam Muginov wrote: Then using kqueue with EVFILT_PROC i can get the notification that observed process forked/execed a child process. How could I know the pid of child process? Unfortunately, you cannot get this information directly from kqueue(3). You can do some sysctl(3) magic, but that's a very large club for this problem. Additionaly, how much overhead for the system adds observing all of the running processes? Is it any other, more lightweight way to watch for newer spawned processes then kqueue? On Mac OS X, launchd attaches kevents to most PIDs on the system. It's a very lightweight mechanism, and your process' contribution to this overhead in the kernel would negligible compared to what's already there anyway. -- Damien Sorresso BSD Engineering Apple Inc. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Rustam Muginov 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:cc:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:references:x-mailer; bh=1cg7ql19YqlNwtbjt1Ki2UXAT6ZwkA1Eg8X/Y2PhZiY=; b=ftGdZTRaAYllV/auuUEhikzdmOggJfJqYHWThPsDXhZwBOt+SNZ1FBili83/VkSgUQ HXyLIY/Dgq66P3eGz+VgE3V+4UOZdpe4i70RvawGq0ZTk0HauTUWmT2qVRw2Re1pyB5D 5lQsMR3vYJOaRynXDKAayNkQX1fKs9UlGhi40= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=cc:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:references :x-mailer; b=gtgIWth3XVQRxLoDrjZwCGhEvv+nBBeu4fKiuYIZ/K70rRhzY3sg5OTlA4hqiqkCHo SsmZoaT8w/qppXlHhrgmWQ651Mb0WV5C5p1z/ZPgfSlyzjaKXgMsKFZR5eTjecqICRb6 hSW5drO1HzG2Ae71satVBZop/1/dTX6FN5mUE= On Oct 12, 2009, at 7:06 PM, Stacey Son wrote: On Oct 12, 2009, at 2:20 AM, Jean-Daniel Dupas wrote: Le 12 oct. 2009 à 01:01, Stacey Son a écrit : On Oct 11, 2009, at 3:01 PM, Dave Keck wrote: FWIW: I never saw a version of OS X that support it. This explains why these flags were deprecated. :) Best Regards, -stacey. -- Sincerely, Rustam Muginov _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. The only docs i found are the Common Criteria manuals about command- line tools and GUI apps here: http://www.apple.com/support/security/commoncriteria/ Are where any examples/code snippets available? I do believe i could use the audit facility from inside my appliction, instead of relying on external command-line tools. Should the process dealing with audit run on behalf of root, or it could be a regular user process? Thank you in advance. As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) This depends on which version of Mac OS you are using... Before 10.5 I believe you could use NOTE_TRACK and NOTE_CHILD to get the PID of the child. The PID of the child would be stored in the ident field and the PID of the parent (aka. PPID) would be stored in the data field. I guess this is no longer the case. See sys/ event.h: /* * DEPRECATED!!!!!!!!! * NOTE_TRACK, NOTE_TRACKERR, and NOTE_CHILD are no longer supported as of 10.5 */ Best Regards, The last time I tried to used them is a simple application, it was triggering a Kernel Panic, until Apple fix that by returning ENOTSUP when trying to register an event with theses flags. Another way to monitor and get the PID of new processes is to use auditing. See the FreeBSD documentation for the details: http://www.freebsd.org/doc/en/books/handbook/audit.html In short, you could audit the fork() and posix_spawn() system call events. The child PIDs are given as arguments to these events. To do this you will need to add the "process" audit class ("pc") to the "flags" and "naflags" fields of /etc/security/audit_control (or better yet, create your own audit class with just these events*) and restart auditing by doing "sudo audit -s" (or rebooting). You can then read the events from either the audit trail files in /var/audit or by reading /dev/auditpipe (see "man auditpipe"). This assumes you are running 10.6. Of course, auditing system call events can add some overhead. To reduce this overhead as much as possible you may want to create a new audit class with just the system events you would like to audit. This is done by edit the /etc/security/audit_class and /etc/ security/audit_event files (see 'man audit_class' and 'man audit_event'). This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Stacey Son 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 12, 2009, at 2:20 AM, Jean-Daniel Dupas wrote: Le 12 oct. 2009 à 01:01, Stacey Son a écrit : On Oct 11, 2009, at 3:01 PM, Dave Keck wrote: FWIW: I never saw a version of OS X that support it. This explains why these flags were deprecated. :) Best Regards, -stacey. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) This depends on which version of Mac OS you are using... Before 10.5 I believe you could use NOTE_TRACK and NOTE_CHILD to get the PID of the child. The PID of the child would be stored in the ident field and the PID of the parent (aka. PPID) would be stored in the data field. I guess this is no longer the case. See sys/ event.h: /* * DEPRECATED!!!!!!!!! * NOTE_TRACK, NOTE_TRACKERR, and NOTE_CHILD are no longer supported as of 10.5 */ Best Regards, The last time I tried to used them is a simple application, it was triggering a Kernel Panic, until Apple fix that by returning ENOTSUP when trying to register an event with theses flags. Another way to monitor and get the PID of new processes is to use auditing. See the FreeBSD documentation for the details: http://www.freebsd.org/doc/en/books/handbook/audit.html In short, you could audit the fork() and posix_spawn() system call events. The child PIDs are given as arguments to these events. To do this you will need to add the "process" audit class ("pc") to the "flags" and "naflags" fields of /etc/security/audit_control (or better yet, create your own audit class with just these events*) and restart auditing by doing "sudo audit -s" (or rebooting). You can then read the events from either the audit trail files in /var/audit or by reading /dev/auditpipe (see "man auditpipe"). This assumes you are running 10.6. Of course, auditing system call events can add some overhead. To reduce this overhead as much as possible you may want to create a new audit class with just the system events you would like to audit. This is done by edit the /etc/security/audit_class and /etc/security/ audit_event files (see 'man audit_class' and 'man audit_event'). This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Jean-Daniel Dupas 12 Oct '09

12 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Le 12 oct. 2009 à 01:01, Stacey Son a écrit : On Oct 11, 2009, at 3:01 PM, Dave Keck wrote: FWIW: I never saw a version of OS X that support it. -- Jean-Daniel _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… As far as getting the the new child's PID, I don't think it's possible using the kevent APIs from userland. (sys/event.h mentions "lower bits contain the PID of the child", but I think this is kernel-only.) This depends on which version of Mac OS you are using... Before 10.5 I believe you could use NOTE_TRACK and NOTE_CHILD to get the PID of the child. The PID of the child would be stored in the ident field and the PID of the parent (aka. PPID) would be stored in the data field. I guess this is no longer the case. See sys/event.h: /* * DEPRECATED!!!!!!!!! * NOTE_TRACK, NOTE_TRACKERR, and NOTE_CHILD are no longer supported as of 10.5 */ Best Regards, The last time I tried to used them is a simple application, it was triggering a Kernel Panic, until Apple fix that by returning ENOTSUP when trying to register an event with theses flags. This email sent to site_archiver(a)lists.apple.com

1 0