November 2004 - Darwin-kernel

Licensing Issue
by Girish 25 Nov '04

25 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=kXdp0PILhqLX1AVyLIHOcmvYN2VdPOrNqXZ24CRLnW81JmdJiVJEtHQozRhl8t7ViE7YBBs6AeNdHnX9suxXSLTnTrcvLdbv37t1p1X4lupVuhag7HciwHqNlb6/nGizccaAN3bQBYzsjnpIWB/FDl6Dde8wjXdffdneIphOODo= ; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: SYS_PROTO socket for nke comm.
by Michael Cashwell 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com struct kern_ctl_reg reginfo; bzero(&reginfo, sizeof(reginfo)); ... reginfo.ctl_flags = CTL_FLAG_PRIVILEGED; ... int nError; nError = ctl_register(&reginfo, NULL, &sRef_RPC); ... -Mike On Nov 24, 2004, at 11:33 AM, Matt Jaffa wrote: Thanks, Matt On Nov 24, 2004, at 9:08 AM, Matt Jaffa wrote: Hi, Thanks, Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I've done this and found that I needed CTL_FLAG_PRIVILEGED to allow only connections from root processes. Since one must init everything in the kern_ctl_reg struct that one isn't using to zero it follows that simply leaving ctl_flags zero would allow non-privileged processes to connect. I must admit that I haven't ever done it but it makes sense and seems to agree with the xnu sources. When defining the kern_ctl_reg structure so that I can use a sys socket to communicate with my NKE, there is 1 flag I see defined in kern_control.h CTL_FLAG_PRIVELIGED which equals 0x1. But no other flags, so I don't know if non-privileged apps can connect to it, or if you just feed a 0 into the flags for that structure and it will let non-root apps connect to it. Any ideas I have a SYS_PROTO socket defined for nke communication. But I have to run the userland app as root, is it possible to make this socket allow non-root apps to connect to it? This email sent to site_archiver(a)lists.apple.com

1 0

Re: thread_policy_set() error
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 19:18 -0800 22/11/04, Arrigo Benedetti wrote: and the function fails with error code 4 (invalid parameters). I am running the code on a Powermac dual G5, where the bus speed is 1250000000. According to thread_policy.h, period, computation and constraint should be specified in Absolute Time units, and I read on an old thread on this list that in a second there should be 1250000000 divided by 4 Absolute Time units. Absolute time units are hardware dependent: they mean completely different things on the G4 and the G5. To generate absolute time values you must consult the time base, which you can get using mach_timebase_info. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernal Extension
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com To: "'carbon-dev(a)lists.apple.com '" <carbon-dev(a)lists.apple.com> Cc: Right now I am trying to excute this: execlp( "/usr/sbin/kmodstat", "/usr/sbin/kmodstat", NULL ); but it seems to just break my pipe. Signal status: 10 int main(...) { OSStatus junk; execve("kmodstat", ...) } Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 13:47 -0600 18/11/04, Setaro, James wrote: First up, please don't cross post between lists. It makes life painful if folks who respond aren't on both lists. I am writing a kernal extension for 10.1.5. I am trying to call kmodstat from inside the of the MoreAuthSample(setuid(0) for admin) tool using pipes(to check the output) and execlp to make sure that my extension is loaded at run-time. I have tried everything I can think of but it won't execute. I think that I am not setting up the enviroment correctly and exec can't find the the kmodstat command, but I don't know where to look for answers on setting this a exec enviroment or if it is even possible to execute kmodstat from execl. kextload and kextunload seem to work fine. Any ideas? Second, don't use execlp from secure code because it depends on the environment (specifically the PATH environment variable). execl is a much better choice. execve is even better because it forces you to explicitly control everything. However, I don't think that this is the root cause of your problem. I don't really know what might be causing it, but I have a good idea of how to start debugging it. It's likely that kmodstat is dependent on some environmental factors that aren't obvious. As MoreSecurity nukes the /entire/ environment, whatever kmodstat is dependent on is having problems. The best way to figure out the environmental dependencies is to write a tiny program that selectively nukes the environment and then exec's kmodstat. Something like: junk = MoreSecDestroyInheritedEnvironment(kMoreSecKeepEverythingMask, argv); assert(junk == noErr); Run this program using "sudo" and see if it works. If so, then selectively remove entries from the kMoreSecKeepEverythingMask until it stops working, or until you've removed everything except kMoreSecKeepStandardFilesMask. This will yield one of two results. o If kmodstat fails, you know that the last environment factor was the one it's dependent on. We can then hunt for an explanation of what it is. o If kmodstat works with a nuked environment, something else is causing the problem. This email sent to site_archiver(a)lists.apple.com

1 0

Re: SYS_PROTO socket for nke comm.
by Matt Jaffa 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thanks, Matt On Nov 24, 2004, at 9:08 AM, Matt Jaffa wrote: Hi, Thanks, Matt This email sent to matt(a)knowligent.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… When defining the kern_ctl_reg structure so that I can use a sys socket to communicate with my NKE, there is 1 flag I see defined in kern_control.h CTL_FLAG_PRIVELIGED which equals 0x1. But no other flags, so I don't know if non-privileged apps can connect to it, or if you just feed a 0 into the flags for that structure and it will let non-root apps connect to it. Any ideas I have a SYS_PROTO socket defined for nke communication. But I have to run the userland app as root, is it possible to make this socket allow non-root apps to connect to it? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ matt%40knowligent.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: kextload error: "not a bundle"
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I've looked through the documentation but nothing makes any mention of this error or how to fix it. o the bundle's Info.plist file doesn't represent a dictionary These are all in the "IOKitUser/kext.subproj/KXKext.c" file. You should check that your KEXT is laid out as follows: MyExtension.kext Contents Info.plist S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 19:02 -0500 17/11/04, Brian Jorgage wrote: I am following the "Hello Kernel" example under Darwin documentation. When I try to load the kext using "sudo kextload -v HelloKernel.kext" I get the following response: "can't load kernel extension HelloKernel.kext (not a bundle)...". Does anyone know how to fix this ? This error is coming from the KEXT manager, specifically the KXKextManagerErrorStringForError routine in "IOKitUser/kext.subproj/KXKextManager.c". If you look for the corresponding error constant (kKXKextManagerErrorNotABundle), you'll find the KEXT manager raises it in the following circumstances: o CFBundleGetIdentifier returns NULL indicating that the KEXT bundle has no CFBundleIdentifier property o CFBundleGetInfoDictionary returns NULL, indicating that the KEXT bundle doesn't have an Info.plist file and that the Info.plist is a proper plist file (try opening it with Property List Editor). This email sent to site_archiver(a)lists.apple.com

1 0

Re: Control an applications file system calls
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com A wise move. If I was doing this I'd probably choose option 1. S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 8:13 +0100 16/11/04, calcmach(a)actcom.net.il wrote: I would like be able to lunch ANY GIVEN application and gain full control over its file system calls (read, write, open, close, etc) Notes: 1) I have NO control over the building of the application I want to intercept..... 2) I have seen such an implementation which involves replacing the entire "mach_kernel", I'd prefer not going down that path. (a kernel extension is OK) You should be able to do this entirely from within user space, and I'd definitely recommend that rather than trying to hack around inside the kernel. I can think of two approaches that might work. 1. debug it -- You could do something similar to what GDB does, that is, run the process as your child and set 'breakpoints' on each of the system calls of interest. This wouldn't work for statically linked binaries, but that's not something that we support on Mac OS X anyway (except for dyld itself, of course). 2. VMM -- A much scarier prospect is to run the target process under Mac OS X's virtual machine monitor (VMM) support. This allows you to redirect all system calls (while the target process is in monitored mode) to the monitor, which is running within the same process. Scary stuff, and totally undocumented. This email sent to site_archiver(a)lists.apple.com

1 0

SYS_PROTO socket for nke comm.
by Matt Jaffa 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, I have a SYS_PROTO socket defined for nke communication. But I have to run the userland app as root, is it possible to make this socket allow non-root apps to connect to it? Thanks, Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Compiling ppp-142 - SCDPlugin, SCPrivate, netisr, in_var header files
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Yes. configd/SystemConfiguration.fproj/SCDPlugin.h configd/SystemConfiguration.fproj/SCPrivate.h xnu/bsd/net/netisr.h xnu/bsd/netinet/in_var.h S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 23:15 -0500 15/11/04, Jim Witte wrote: Are these header files somewhere else in the Darwin codebase This email sent to site_archiver(a)lists.apple.com

1 0

Re: IPOPT_RA
by Quinn 24 Nov '04

24 Nov '04

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Currently, I am making a program to intercept UDP packet which contains IP Router Alert Option (IPOPT_RA). I would like to ask whether Mac OS X kernel (Darwin 7.5) supports this IP option (in IPv4)? S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 14:08 +0900 12/11/04, baskara wrote: I don't think it does. The IPOPT_RA string appears twice in the Mac OS X 10.3 source: the first is the definition in "ip.h" and the second is in "igmp.c", where it's constructing an outgoing packet. This email sent to site_archiver(a)lists.apple.com

1 0