February 2003 - Darwin-kernel

Re: Baffled
by Michael Cashwell 14 Feb '03

14 Feb '03

Greetings, I ran into something like this a while back (my KEXT silently not loading). My case wasn't that I'd tossed the build directory. I can't completely remember the details but I think I had the start and stop functions not exported properly. In any case, I do remember that I figured it out by adding "-v 6" to the kextload command. This causes it to generate a verbose log of the load attempt. If there is a missing function or dependency problem this should expose it. Try this and if you're still stuck post the results. (I also always ran a tail -f on the system.log file.) Best regards, Mike On Thursday, February 13, 2003, at 07:26 PM, Eric Long wrote: Hi, I've encountered a bizarre problem that has me completely baffled. Maybe someone knows what's going on... I have a network kernel extension that I've been working on for the last few months. It has loaded, spit out messages to the system log, and unloaded all as expected for all that time, until today. For reasons I can't begin to imagine, now when I load the kext, I get no errors reported, but The kext MODULE_START and MODULE_STOP functions never get called. I can't come up with any change that I have made that could cause this to break, except that I tossed my build folder, to force a complete rebuild without remnants from the past. I'm using Project Builder 2.1 on 10.2.3 (and 10.2.4). I even tried checking out a previously tagged version that was known to work properly. I get the same problem with it. It's like there was something in that old build folder that made things ok, that's now gone. The kext includes a client interface implemented through an IOKit personality. That all seems to work fine. It's just the NKE side of things that's not happening. Any thoughts? Eric Long _______________________________________________________________________ ____ Macintosh Software Engineer Aladdin Systems, Inc. http://www.aladdinsys.com 245 Westridge Drive, Watsonville, CA 95076 (831) 761-6200 x628 _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Baffled
by Eric Long 14 Feb '03

14 Feb '03

Hi, I've encountered a bizarre problem that has me completely baffled. Maybe someone knows what's going on... I have a network kernel extension that I've been working on for the last few months. It has loaded, spit out messages to the system log, and unloaded all as expected for all that time, until today. For reasons I can't begin to imagine, now when I load the kext, I get no errors reported, but The kext MODULE_START and MODULE_STOP functions never get called. I can't come up with any change that I have made that could cause this to break, except that I tossed my build folder, to force a complete rebuild without remnants from the past. I'm using Project Builder 2.1 on 10.2.3 (and 10.2.4). I even tried checking out a previously tagged version that was known to work properly. I get the same problem with it. It's like there was something in that old build folder that made things ok, that's now gone. The kext includes a client interface implemented through an IOKit personality. That all seems to work fine. It's just the NKE side of things that's not happening. Any thoughts? Eric Long ___________________________________________________________________________ Macintosh Software Engineer Aladdin Systems, Inc. http://www.aladdinsys.com 245 Westridge Drive, Watsonville, CA 95076 (831) 761-6200 x628 _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Rebooting the victim machine using gdb, the answer
by Timothy Standing 11 Feb '03

11 Feb '03

A week ago I posted a question regarding how to reboot a victim machine using gdb in two machine debugging mode. Here's the answer (thank you Quinn for getting me started on the right track): In your driver source code add the following procedure: void DebugRestart() { (*PE_halt_restart)(kPERestartCPU); } After you have loaded the symbols from the victim machine into gdb running on the development machine, you can then type call DebugRestart() and your machine will reboot. Alternately, you can define a reboot command in your .gdbinit file and keep the typing to a minimum. For example: define rb call DebugRestart() end This allows you to type "rb" to get the vicim machine to reboot. I hope this proves helpful to people. Tim Standing SoftRAID, LLC _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: customization of Darwin kernel
by Jonas Maebe 11 Feb '03

11 Feb '03

On maandag, feb 10, 2003, at 20:42 Europe/Brussels, Matthias Kretschmer wrote: So there should be some way, but as far as I understand openfirmware and stuff, I will be able to enter openfirmware and noone will stop me. You can lock open firmware using a password and at the same time prevent cd booting, alt-booing, firewire booting etc. See <http://docs.info.apple.com/article.html?artnum=120095> for more info. The only way to reset te password is by adding/removing ram, so if you lock the computer case, it's pretty safe. Jonas _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: customization of Darwin kernel
by Matthias Kretschmer 10 Feb '03

10 Feb '03

> I am aware that many of the options I am requesting information about > are availible as extensions, modules, and configuration file options. > However, I am still interested in enabling / disabling these options at > the kernle level. For example, when I asked about the KERNEL LEVEL > customization of allowing or disallowing IP packet forwarding I am more > interested in DISABLING it via the kernel. Basically as written above it is done via a sysctl, which can only be performed by root (or sudo enabled users with root access - the administrator checkbox does this). So if you explicitly set this to zero, nobody can do forwarding, removing the entire code from the kernel should not change much, because someone with root priveledges should be able to boot any kernel, so even with no kernel on the box, one could create one and put it on the box if there is somehow access from/to the outside (network, disks, cds, etc.). So there shouldn't be any other risk. > [...] Additionaly, disabling a > CD-burner in kernel space has its reasons as well. Assume I want the > ability to burn CD's and am willing to swap kernels for this. I want to > be assured that other users of my systems ARE NOT burning CD's which may > contain > proprietary data. Essentially trusted users have access to the CD-R > enabled kernel... other users dont. These are the kinds of "hobby > projects" that I work on! Admittedly these proceedures are a bit > extreem...but as a security consultant I am always interested in the > MANY ways a solution could be achieved. One question would be, how you will do the trick, that only special recignized people are able to boot one specific kernel? At least the standard boot process does not enable one to choose which kernel to boot after authentication. The user authentication is done after kernel is loaded. So there should be some way, but as far as I understand openfirmware and stuff, I will be able to enter openfirmware and noone will stop me. At least if there is some password feature, I could simply erase nvram/etc. using some killing keystroke or pressing some button (it is done with some key-combination on my iBook) and then using standard key combination to enter open firmware and tell it by hand, which kernel to boot. On the other hand, you could simply use darwins ability to load kernel extensions at runtime (and unload them) without changing kernels. If just one kernel extension is used for burning CDs (and this is not done through the userland tools which just need raw access to CD-writers) you could disable it. But maybe all the stuff is done in userland, so there would be two solutions: a) disabling whole CD/CD-writer access (so no reading of CDs possible) b) enabling all Well there would be another solution. As far as I understand, CD-writers need direct access to the drivers to send them arbitrary commands. Maybe you are able to just disable this ability, maybe this can be done by changing some sysctl. -- Greetings Matthias Kretschmer _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: MiG Subsystem
by David Blanton 10 Feb '03

10 Feb '03

On 2/10/03 1:49 AM, "Quinn" <eskimo1(a)apple.com> wrote: > At 9:00 -0700 7/2/03, David Blanton wrote: >> In the entry: >> >> subsystem random 500; >> >> In a .def file for MIGGING what is the 500 parameter? >> >> And, is there a generic subsystem? > > [I'm sure Jim will correct me if I'm wrong, but here goes...] MIG > generates code to pack the function parameters you supply into a > parameter block and send that parameter block in a message to the > destination port. On the server side, the MIG code takes that > parameter block, unpacks it, and calls the relevant function. The > MIG server decides which message is which by examining a message type > selector. These message type values are determined by the subsystem > value. So, if you have a .defs file that looks like this: > > ------------------------------------------------------------- > subsystem MySubsystem 10000; > > routine MyRoutine1(...); > > routine MyRoutine2(...); > > routine MyRouinee3(...); > ------------------------------------------------------------- > > then the MyRoutine1 is assigned 10000 as its selector, MyRoutine2 > uses 10001, MyRouinee3 uses 10002, and so on. > > The actual values that you use are irrelevant except that: > > o if you have multiple services listening on the same Mach port, each > service must have a distinct range, and > > o if you want to maintain release-to-release binary compatibility, > you have to make sure that the numbers are stable. > >>> What is the meaning/use of MySubsystem in subsystem >>> MySubsystem above. It is implied that servers are associated with >>> a particular subsystem and that to define ones own subsystem is a >>> non-trivial task. Can someone shed some light on subsystems. Thanks. Peace. DB _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: MiG Subsystem
by Quinn 10 Feb '03

10 Feb '03

At 9:00 -0700 7/2/03, David Blanton wrote: In the entry: subsystem random 500; In a .def file for MIGGING what is the 500 parameter? And, is there a generic subsystem? [I'm sure Jim will correct me if I'm wrong, but here goes...] MIG generates code to pack the function parameters you supply into a parameter block and send that parameter block in a message to the destination port. On the server side, the MIG code takes that parameter block, unpacks it, and calls the relevant function. The MIG server decides which message is which by examining a message type selector. These message type values are determined by the subsystem value. So, if you have a .defs file that looks like this: ------------------------------------------------------------- subsystem MySubsystem 10000; routine MyRoutine1(...); routine MyRoutine2(...); routine MyRouinee3(...); ------------------------------------------------------------- then the MyRoutine1 is assigned 10000 as its selector, MyRoutine2 uses 10001, MyRouinee3 uses 10002, and so on. The actual values that you use are irrelevant except that: o if you have multiple services listening on the same Mach port, each service must have a distinct range, and o if you want to maintain release-to-release binary compatibility, you have to make sure that the numbers are stable. S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: customization of Darwin kernel
by Brian Tabone 08 Feb '03

08 Feb '03

Mr. Wong, I did some quick research in the source code for Darwin, in xnu/bsd/netinet/ip_input.c, there is an integer called ipforwarding and the definition of the sysctl that accesses it (They are around line 125 of this file). Anyhow, you could comment out the definition for the sysctl and leave ipforwarding initialized as 0, and this would lock off ip forwarding for your users of your custom kernel by removing access via sysctl to this variable. Note I have not tested this method, I base my statements off of what I see in the code. Your milage may vary :) The drawback here though is that a savy root user with a debugger and a symbol table could find this variable in /dev/kmem and set it to 1 the hard way. You may wish to actually remove all the forwarding code from the kernel itself if you are feeling adventurous. I'm not certain where CD burning is enabled in the kernel, sorry I couldn't be of more help with that part of your question. -Hope that helps, Brian Tabone On Saturday, February 8, 2003, at 12:13 PM, Mr. Wong wrote: Once again THANKS to all those who have replied to my questions. Your comments are much appreciated and are helping me further understand the Darwin (as well as other Linux) Kernels. I am aware that many of the options I am requesting information about are availible as extensions, modules, and configuration file options. However, I am still interested in enabling / disabling these options at the kernle level. For example, when I asked about the KERNEL LEVEL customization of allowing or disallowing IP packet forwarding I am more interested in DISABLING it via the kernel. Why? In the past I have constructed a more secure Linux machine by disabling "dangerous" kernel level options such as IP packet forwarding or promiscuous mode to prevent packet sniffing on my network. Additionaly, disabling a CD-burner in kernel space has its reasons as well. Assume I want the ability to burn CD's and am willing to swap kernels for this. I want to be assured that other users of my systems ARE NOT burning CD's which may contain proprietary data. Essentially trusted users have access to the CD-R enabled kernel... other users dont. These are the kinds of "hobby projects" that I work on! Admittedly these proceedures are a bit extreem...but as a security consultant I am always interested in the MANY ways a solution could be achieved. Anyway, I would be interested in disabling many features in the Darwin Kernel. Also I am interested in tweaking / creating kernel extensions... which I have done to a very basic extent by following FAQ's about how to create a simple kernel extension in Darwin. Thanks to Pelle Johansson for pointing out which files might be of interest to me: However, if you really want to do it, what you do is edit the xnu/*/conf/MASTER.ppc files (on ppc, obviously). --Cheers, Matthew K. Wong Date: Fri, 7 Feb 2003 14:14:58 +0100 Subject: Re: Kernel customization. > Cc: darwin-kernel(a)lists.apple.com To: "Mr. Wong" > From: Pelle Johansson > onsdagen den 5 februari 2003 kl 02.26 skrev Mr. Wong: >> Hello everyone, I recently compiled the Darwin (XNU portion v.6.0) >> kernel >> with the help from the users of this newsgroup (thanks!). I would like >> to take this a step further and actually do some kernel customizations >> similar to the ones I've done in Linux. For example, I've recompiled >> the >> Linux kernel to specifically allow or disallow cd burning capabilities >> via SCSI emulation support. Another thing I've done in linux is allow >> IP >> packet forwarding. The Redhat (7.3) Linux kernel appears to be much >> easier to handle than the Darwin kernel because there exists GUI and >> command line utilities built specifically for the purpose of >> custization. Anyway, my question is this: How does one go about >> modifying the XNU kernel to achieve such customizations? Is there a >> GUI >> or command line utility? What suggestions do you have or what should I >> watch out for? Any help will be appreciated. Thanks in advance, >> Matthew >> K. Wong >Well, you got a lot of replies telling you not to, and I agree with >them. Most things are turned on by default. IP forwarding certainly is, >and AFAIK, cd burning is handled completely by the cd iokit driver, >which is a kernel extension (src/live/IOCDStorageFamily in cvs). >However, if you really want to do it, what you do is edit the >xnu/*/conf/MASTER.ppc files (on ppc, obviously). >By modifying the line RELEASE = [...] you can add and remove options. >Of course, it's not completely obvious what options are available, >you'll have to look around in the files in the conf/ directories to >find out. ----------------------------------------------------------------------- - MSN 8 helps ELIMINATE E-MAIL VIRUSES. Get 2 months FREE*. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: customization of Darwin kernel
by Mr. Wong 08 Feb '03

08 Feb '03

Once again THANKS to all those who have replied to my questions. Your comments are much appreciated and are helping me further understand the Darwin (as well as other Linux) Kernels. I am aware that many of the options I am requesting information about are availible as extensions, modules, and configuration file options. However, I am still interested in enabling / disabling these options at the kernle level. For example, when I asked about the KERNEL LEVEL customization of allowing or disallowing IP packet forwarding I am more interested in DISABLING it via the kernel. Why? In the past I have constructed a more secure Linux machine by disabling "dangerous" kernel level options such as IP packet forwarding or promiscuous mode to prevent packet sniffing on my network. Additionaly, disabling a CD-burner in kernel space has its reasons as well. Assume I want the ability to burn CD's and am willing to swap kernels for this. I want to be assured that other users of my systems ARE NOT burning CD's which may contain proprietary data. Essentially trusted users have access to the CD-R enabled kernel... other users dont. These are the kinds of "hobby projects" that I work on! Admittedly these proceedures are a bit extreem...but as a security consultant I am always interested in the MANY ways a solution could be achieved. Anyway, I would be interested in disabling many features in the Darwin Kernel. Also I am interested in tweaking / creating kernel extensions... which I have done to a very basic extent by following FAQ's about how to create a simple kernel extension in Darwin. Thanks to Pelle Johansson for pointing out which files might be of interest to me: >However, if you really want to do it, what you do is edit the >xnu/*/conf/MASTER.ppc files (on ppc, obviously). --Cheers, Matthew K. Wong > Date: Fri, 7 Feb 2003 14:14:58 +0100 > Subject: Re: Kernel customization. > Cc: darwin-kernel(a)lists.apple.com > To: "Mr. Wong" > From: Pelle Johansson > onsdagen den 5 februari 2003 kl 02.26 skrev Mr. Wong: >> Hello everyone, I recently compiled the Darwin (XNU portion v.6.0) >> kernel >> with the help from the users of this newsgroup (thanks!). I would like >> to take this a step further and actually do some kernel customizations >> similar to the ones I've done in Linux. For example, I've recompiled >> the >> Linux kernel to specifically allow or disallow cd burning capabilities >> via SCSI emulation support. Another thing I've done in linux is allow >> IP >> packet forwarding. The Redhat (7.3) Linux kernel appears to be much >> easier to handle than the Darwin kernel because there exists GUI and >> command line utilities built specifically for the purpose of >> custization. Anyway, my question is this: How does one go about >> modifying the XNU kernel to achieve such customizations? Is there a >> GUI >> or command line utility? What suggestions do you have or what should I >> watch out for? Any help will be appreciated. Thanks in advance, >> Matthew >> K. Wong >Well, you got a lot of replies telling you not to, and I agree with >them. Most things are turned on by default. IP forwarding certainly is, >and AFAIK, cd burning is handled completely by the cd iokit driver, >which is a kernel extension (src/live/IOCDStorageFamily in cvs). >However, if you really want to do it, what you do is edit the >xnu/*/conf/MASTER.ppc files (on ppc, obviously). >By modifying the line RELEASE = [...] you can add and remove options. >Of course, it's not completely obvious what options are available, >you'll have to look around in the files in the conf/ directories to >find out. ------------------------------------------------------------------------ MSN 8 helps ELIMINATE E-MAIL VIRUSES. Get 2 months FREE*. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

MiG Subsystem
by David Blanton 07 Feb '03

07 Feb '03

In the entry: subsystem random 500; In a .def file for MIGGING what is the 500 parameter? And, is there a generic subsystem? Peace. DB _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0