February 2009 - Darwin-dev - lists.apple.com

Re: GCC stack size
by Steve Checkoway 21 Feb '09

21 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Feb 20, 2009, at 4:54 PM, Jan Brittenson wrote: Catches up? [hilbert:~] steve$ uname -s -r Linux 2.6.27-7-generic [hilbert:~] steve$ gcc --version gcc (Ubuntu 4.3.2-1ubuntu12) 4.3.2 [PBG4:~] steve$ uname -s -r Darwin 9.6.0 [PBG4:~] steve$ gcc-4.2 --version powerpc-apple-darwin9-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 5566) -- Steve Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… The difference from your Linux driver is probably just a function of gcc version used. When your Linux build environment catches up you'll likely find you have the foot print issues there as well. This email sent to site_archiver(a)lists.apple.com

1 0

Developer available
by Michael Prenez-Isbell 21 Feb '09

21 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTx9PruM5g7vay2024yCLLMxVGYw== Thread-topic: Developer available User-agent: Microsoft-Entourage/12.15.0.081119 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: GCC stack size
by Jan Brittenson 21 Feb '09

21 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Thunderbird 2.0.0.19 (Macintosh/20081209) These are shorthand to turn on/off the various optimization options. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Ryan McGann wrote: We are currently using -O3 because the code is pretty compute-bound, and on other platforms -O3 has a nice 5% boost compared to -O2. But changing it to -O2 doesn't even help, we have to go all the way to -O1 to get a usable stack of 400 bytes (still 4x larger than our Linux driver). If I were you I'd find out what exactly they expand to, and which of the options cause the stack bloat. Then I'd explicitly turn off that, or those, optimizations. It may take some guesswork and experimentation with the a la carte options. You might also be able to find a way to reorder the code to work around. For instance, if it's caused by -fstack-realign, then try compiling with -O3 -fno-stack-realign. The difference from your Linux driver is probably just a function of gcc version used. When your Linux build environment catches up you'll likely find you have the foot print issues there as well. This email sent to site_archiver(a)lists.apple.com

1 0

GCC stack size
by Ryan McGann 21 Feb '09

21 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thanks, Ryan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… A couple weeks ago I asked about a machine-check panic I was getting. As it turns out, my suspicions were right about stack corruption. I disassembled a function in our kext and saw that for some reason, GCC's function prologue was allocating around 1660 bytes of stack (in release, debug was slightly better at 1140 bytes). On other platforms compiled with GCC (FreeBSD and many different Linux distros) the stack usage is near 110 bytes, but for some reason gcc on Mac OS X is allocating almost 4K. We are currently using -O3 because the code is pretty compute-bound, and on other platforms -O3 has a nice 5% boost compared to -O2. But changing it to -O2 doesn't even help, we have to go all the way to -O1 to get a usable stack of 400 bytes (still 4x larger than our Linux driver). The code is vanilla C++ without anything fancy—no virtual functions even. There are no warnings about temporarys being used, so I have no clue what is causing the stack usage. It's a huge function with a lot ofswitch statements and for loops, but not a lot of function calls, mostly just computes on arrays of data. My best guess is that GCC is trying to optimize the intermediate operations and temporary results by placing them on the stack. Anybody have ideas on how to show where GCC is allocating things in the frame, and how to reduce the stack usage? It's hard to distill this to a single issue because the function is so large, but I am tempted to file a bug since GCC 4 optimizes things quite nicely on other platforms. This email sent to site_archiver(a)lists.apple.com

1 0

ACL Inheritance?
by Benjamin Huntsman 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTs36HuKgPjkpkQBGkB0xo3q6B9g== Thread-topic: ACL Inheritance? Hi all! This may not be the right list, but perhaps someone could point me in the right direction regarding ACL's on Mac OS X... I've got an XServe running 10.4, with an attached Xserve RAID. The raid array is running XSan, and mounted as a single volume under /Volumes. The Xserve is joined to an Active Directory domain, which it uses for authentication. The folders at the root of the XSan volume are configured as SMB shares, so that Windows clients can access them. So here's the catch... we want to have a certain group in the Active Directory domain control access to one of the folders on the Xsan volume. When the server was set up, they were using UNIX permissions (user, group, others) to configure access, which became problematic as more and more users were added to the system. Switching to ACL's after the fact though, hasn't worked very well. The Active Directory group is added in Workgroup Manager to the folder, and set to propagate, but it doesn't do so to all subfolders, especially those that were present before the change. I set up a test volume on a dmg to experiment via the command line, and found that if you set an ACL with inheritance on a folder that ALREADY contains a subfolder, the subfolder won't automatically inherit the ACL from it's parent, but all subsequently created folders or files will. So my question is, is there a way, via the command line or otherwise, to essentially tell a folder or file to "re-inherit" it's ACL list from it's parent? I can do 'chmod -R +a "<acl>" folder', but that's not what we're after... Many thanks to all in advance!! -Ben _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Signing Examples
by Tim Murison 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTm13RnDFBsFkXTMGzTyCoOkhgzQAAxBsQAADcO+U= Thread-topic: Code Signing Examples User-agent: Microsoft-Entourage/12.15.0.081119 > That is a good point. Someone else also pointed out that once a hacker gets > root authority all bets are off. Ideally this level of authentication > belongs in the OS. Once a signed application or process is installed the OS > should enforce the signature before executing the process. Not sure if this > can be done with 10.5 or 10.6. And I'm not sure how you prevent someone > from replacing the module with a corrupt unsigned version. For now we are > just looking for a reasonable approach to validate the authenticity of our > application components. Once the process is running, the code signing API allows you to check the signature of the process based on its PID. You might also want to investigate the "hard" and "kill" options to codesign. My understanding is that "hard" should prevent (in some cases, not sure which) applications with broken signatures from running, and "kill" should kill the process when its signature becomes invalid (again, not sure in which cases). *********************************************************************** This e-mail and its attachments are confidential, legally privileged, may be subject to copyright and sent solely for the attention of the addressee(s). Any unauthorized use or disclosure is prohibited. Statements and opinions expressed in this e-mail may not represent those of Radialpoint. Le contenu de ce courriel est confidentiel, privilégié et peut être soumis à des droits d'auteur. Il est envoyé à l'intention exclusive de son ou de ses destinataires. Il est interdit de l'utiliser ou de le divulguer sans autorisation. Les opinions exprimées dans le présent courriel peuvent diverger de celles de Radialpoint. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

RE: Code Signing Examples
by Tom Fortmann 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTm13RnDFBsFkXTMGzTyCoOkhgzQAAxBsQ That is a good point. Someone else also pointed out that once a hacker gets root authority all bets are off. Ideally this level of authentication belongs in the OS. Once a signed application or process is installed the OS should enforce the signature before executing the process. Not sure if this can be done with 10.5 or 10.6. And I'm not sure how you prevent someone from replacing the module with a corrupt unsigned version. For now we are just looking for a reasonable approach to validate the authenticity of our application components. ___________________________________ Thomas Fortmann Director of Development Xcape Solutions, Inc. 207 Crystal Grove Blvd. Lutz, FL 33548 TEL 847 228 9831 www.xcapesolutions.net tfortmann(a)xcapesolutions.net -----Original Message----- From: Damien Sorresso [mailto:dsorresso@apple.com] Sent: Friday, February 20, 2009 2:40 PM To: Tom Fortmann Cc: cocoa-dev(a)lists.apple.com; darwin-dev(a)lists.apple.com Subject: Re: Code Signing Examples On Feb 20, 2009, at 6:47 AM, Tom Fortmann wrote: > Can anyone point me to sample code on how to verify an application > or process is signed? My application executes a couple other > processes and I would like to validate their signatures before I > blindly execute them. I've found a ton of Apple documentation on > the theory but not a lot on practical application within my code. > I've also looked at simply running the codesign utility and parsing > its XML output, but this seems like a weak design. What is codesign > gets replaced? Keep in mind that you'll be subject to a "time of check versus time of use" race condition. Even if you verify that the binaries on-disk are valid, someone could swap out the binary for an evil one just after the check and just before the exec(2). -- Damien Sorresso BSD Engineering Apple Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Code Signing Examples
by Damien Sorresso 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com On Feb 20, 2009, at 6:47 AM, Tom Fortmann wrote: Can anyone point me to sample code on how to verify an application or process is signed? My application executes a couple other processes and I would like to validate their signatures before I blindly execute them. I’ve found a ton of Apple documentation on the theory but not a lot on practical application within my code. I’ve also looked at simply running the codesign utility and parsing its XML output, but this seems like a weak design. What is codesign gets replaced? Keep in mind that you'll be subject to a "time of check versus time of use" race condition. Even if you verify that the binaries on-disk are valid, someone could swap out the binary for an evil one just after the check and just before the exec(2). -- Damien Sorresso BSD Engineering Apple Inc. smime.p7s

1 0

Re: Code Signing Examples
by Tim Murison 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTah8xqupN7TGySOixJs6Gaa67wQAFrkOB Thread-topic: Code Signing Examples User-agent: Microsoft-Entourage/12.15.0.081119 > Can anyone point me to sample code on how to verify an application or > process is signed? My application executes a couple other processes and I > would like to validate their signatures before I blindly execute them. I've > found a ton of Apple documentation on the theory but not a lot on practical > application within my code. I've also looked at simply running the codesign > utility and parsing its XML output, but this seems like a weak design. What > is codesign gets replaced? I've recently finished implementing exactly what you are talking about. I based my work on this patent filed by Apple: http://www.freepatentsonline.com/y2008/0168553.html If you take a look, they describe, in 6 lines, how to verify the signature of a running process. The functions they use are implemented in libsecurity_codesigning which is opensource and available from the darwin opensource page and compiled into the Security.framework. I'm pretty sure the APIs are private and not necessarily portable to future versions of OS X. *********************************************************************** This e-mail and its attachments are confidential, legally privileged, may be subject to copyright and sent solely for the attention of the addressee(s). Any unauthorized use or disclosure is prohibited. Statements and opinions expressed in this e-mail may not represent those of Radialpoint. Le contenu de ce courriel est confidentiel, privilégié et peut être soumis à des droits d'auteur. Il est envoyé à l'intention exclusive de son ou de ses destinataires. Il est interdit de l'utiliser ou de le divulguer sans autorisation. Les opinions exprimées dans le présent courriel peuvent diverger de celles de Radialpoint. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Code Signing Examples
by Tom Fortmann 20 Feb '09

20 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcmTah8xqupN7TGySOixJs6Gaa67wQ== _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0