June 2005 - Darwin-kernel - lists.apple.com

Re: auditing in Darwin?
by Wayne Salamon 24 Jun '05

24 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Jun 23, 2005, at 1:23 PM, Todd Heberlein wrote: /* * Darwin defines the size for fileid as 4 bytes; * BSM defines 8. So we copy in a 0 first. */ fileid = vni->vn_fileid; ADD_U_INT32(dptr, pad0_32); ADD_U_INT32(dptr, fileid); Wayne ------------------------ Wayne Salamon wsalamon(a)computer.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I don't know what that 4-byte field is at the end, but I need to read it in before I can get properly aligned for the next token. Actually, what you're seeing is an extra four bytes before the fileid; here's the code snippet from the kernel (bsd/kern/ kern_bsm_token.c): So it's intentional. Unfortunately, the Solaris 9 documentation doesn't show the exact field lengths (Solaris 8 docs do, and fileid is 4 bytes). But we didn't make the 8 bytes up out of thin air, so more research is required. In OpenBSM, the code checks the size and writes either 4 or 8 bytes, BTW. This email sent to site_archiver(a)lists.apple.com

1 0

Re: [XNU792.1.5] udp_lock x86 bug?
by Laurent Dumont 24 Jun '05

24 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Microsoft-Entourage/11.1.0.040913 Stéphane, Please file a bug about this. You may have noticed that support for debugging the socket locking )available on PPC to keep the link register) is not available in xnu-792.1.5 for x86. The content of those "so_reserved" fields are floating on that architecture in that kernel. I'd like to take the opportunity to remind you guys to please do not rely on these internal structures in any of your kexts, as they WILL change and are not part of the supported KPIs. Thanks Laurent on 6/24/05 04:35, Stephane Sudre at ssudre(a)intego.com wrote: > Is there not a bug in udp_lock when it comes to x86 architecture: > > int > udp_lock(so, refcount, debug) > struct socket *so; > int refcount, debug; > { > int lr_saved; > #ifdef __ppc__ > if (debug == 0) { > __asm__ volatile("mflr %0" : "=r" (lr_saved)); > } > else lr_saved = debug; > #endif > > if (so->so_pcb) { > lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, > LCK_MTX_ASSERT_NOTOWNED); > lck_mtx_lock(((struct inpcb *)so->so_pcb)->inpcb_mtx); > } > else { > panic("udp_lock: so=%x NO PCB! lr=%x\n", so, lr_saved); > lck_mtx_assert(so->so_proto->pr_domain->dom_mtx, > LCK_MTX_ASSERT_NOTOWNED); > lck_mtx_lock(so->so_proto->pr_domain->dom_mtx); > } > > if (refcount) > so->so_usecount++; > > so->reserved3= lr_saved; > return (0); > } > > lr_saved is not initialized as far as I can see if __ppc__ is not > defined. > > There's no warning in gcc when building on a x86? > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/laurent%40apple.com > > This email sent to laurent(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

[XNU792.1.5] udp_lock x86 bug?
by Stephane Sudre 24 Jun '05

24 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Is there not a bug in udp_lock when it comes to x86 architecture: int udp_lock(so, refcount, debug) struct socket *so; int refcount, debug; { int lr_saved; #ifdef __ppc__ if (debug == 0) { __asm__ volatile("mflr %0" : "=r" (lr_saved)); } else lr_saved = debug; #endif if (refcount) so->so_usecount++; so->reserved3= lr_saved; return (0); } There's no warning in gcc when building on a x86? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… if (so->so_pcb) { lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_NOTOWNED); lck_mtx_lock(((struct inpcb *)so->so_pcb)->inpcb_mtx); } else { panic("udp_lock: so=%x NO PCB! lr=%x\n", so, lr_saved); lck_mtx_assert(so->so_proto->pr_domain->dom_mtx, LCK_MTX_ASSERT_NOTOWNED); lck_mtx_lock(so->so_proto->pr_domain->dom_mtx); } lr_saved is not initialized as far as I can see if __ppc__ is not defined. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Install KEXT with PageMaker
by Stephane Sudre 23 Jun '05

23 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On vendredi, juin 24, 2005, at 12:20 AM, Carl Smith wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I was looking for some information, documentation and our examples of installing a kernel driver, maybe with using PageMaker, because I have a user application to install at the same time. I would like the KEXT to start each time the MAC machine is started, like some of the existing KEXT, i.e. IPFirewall, SharedIP. I did read some thing about creating a ‘startup item’ for the NKE, but did not find any good documentation. FYI my KEXT is a NKE Can anyone point me in the right direction for some of this information? 1. Don't use PageMaker, use PackageMaker. It will work better (though the layout will be a bit different). Be aware that your StartupItem hierarchy will need to root:wheel and 755 (or 644). 2. There is a HOWTO Darwin documentation on StartupItem and Kernel Extensions: http://developer.apple.com/documentation/Darwin/Conceptual/KEXTConcept/ index.html This makes me discover the "Packaging Scientific UNIX software for Mac OS X" documentation at http://developer.apple.com/documentation/Darwin/Conceptual/howto/ packaging_unix_for_darwin/packaging_unix_for_darwin.html is obsolete as softrak has been down for 2 years or so.. But IMHO, just have a look at the IPFirewall one on a 10.1 or 10.2 OS X machine and modify it to do what you want. This email sent to site_archiver(a)lists.apple.com

1 0

Install KEXT with PageMaker
by Carl Smith 23 Jun '05

23 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thread-index: AcV4QchSV410EI1xTeGvCO1jXiCWlg== Thread-topic: Install KEXT with PageMaker _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: auditing in Darwin?
by Todd Heberlein 23 Jun '05

23 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com The binary output of the audit record consists of 4 columns: (1) byte position (2) decimal value of the byte (3) hexadecimal value of the byte (4) ASCII value of the byte inside brackets - file mode (4 bytes) - owner UID (4 bytes) - owner GID (4 bytes) - file system ID (4 bytes) - file inode ID (4 bytes) - device ID (4 bytes) - mysterious field (4 bytes) Todd praudit output: ------------------------------ header,119,1,execve(2),0,Tue May 31 11:00:53 2005, + 616 msec path,/bin/ls path,/bin/ls attribute,100555,root,wheel,234881026,0,0 subject,heberlei,heberlei,staff,heberlei,staff,417,245,50331650,0.0.0.0 return,success,417 trailer,119 ------------------------------ Output from my parser: ------------------------------ Header: 20,119,1,23,0,1117562453,616 Subject: 36,501,501,20,501,20,417,245,50331650,0 Return: 39,0,417 Trailer: 19,45317,119 ----- Header ----- 0 020 0014 [ ] <-- Header Token 1 000 0000 [ ] 2 000 0000 [ ] 3 000 0000 [ ] 4 119 0077 [w] 5 001 0001 [ ] 6 000 0000 [ ] 7 023 0017 [ ] 8 000 0000 [ ] 9 000 0000 [ ] 10 066 0042 [B] 11 156 009c [ ] 12 166 00a6 [ ] 13 085 0055 [U] 14 000 0000 [ ] 15 000 0000 [ ] 16 002 0002 [ ] 17 104 0068 [h] ----- Body ----- 0 035 0023 [#] <-- AU_PATH_TOKEN 1 000 0000 [ ] 2 008 0008 [ ] 3 047 002f [/] 4 098 0062 [b] 5 105 0069 [i] 6 110 006e [n] 7 047 002f [/] 8 108 006c [l] 9 115 0073 [s] 10 000 0000 [ ] 11 035 0023 [#] <-- AU_PATH_TOKEN 12 000 0000 [ ] 13 008 0008 [ ] 14 047 002f [/] 15 098 0062 [b] 16 105 0069 [i] 17 110 006e [n] 18 047 002f [/] 19 108 006c [l] 20 115 0073 [s] 21 000 0000 [ ] 22 062 003e [>] <-- AU_ATTR32_TOKEN 23 000 0000 [ ] - file mode (4 bytes) 24 000 0000 [ ] 25 129 0081 [ ] 26 109 006d [m] 27 000 0000 [ ] - owner UID (4 bytes) 28 000 0000 [ ] 29 000 0000 [ ] 30 000 0000 [ ] 31 000 0000 [ ] - owner GID (4 bytes) 32 000 0000 [ ] 33 000 0000 [ ] 34 000 0000 [ ] 35 014 000e [ ] - file system ID (4 bytes) 36 000 0000 [ ] 37 000 0000 [ ] 38 002 0002 [ ] 39 000 0000 [ ] - file inode ID (4 bytes) 40 000 0000 [ ] 41 000 0000 [ ] 42 000 0000 [ ] 43 000 0000 [ ] - device ID (4 bytes) 44 000 0000 [ ] 45 000 0000 [ ] 46 000 0000 [ ] 47 000 0000 [ ] - mysterious field (4 bytes) 48 000 0000 [ ] 49 000 0000 [ ] 50 000 0000 [ ] 51 036 0024 [$] <-- AU_SUBJECT_32_TOKEN 52 000 0000 [ ] 53 000 0000 [ ] 54 001 0001 [ ] 55 245 00f5 [ ] 56 000 0000 [ ] 57 000 0000 [ ] 58 001 0001 [ ] 59 245 00f5 [ ] 60 000 0000 [ ] 61 000 0000 [ ] 62 000 0000 [ ] 63 020 0014 [ ] 64 000 0000 [ ] 65 000 0000 [ ] 66 001 0001 [ ] 67 245 00f5 [ ] 68 000 0000 [ ] 69 000 0000 [ ] 70 000 0000 [ ] 71 020 0014 [ ] 72 000 0000 [ ] 73 000 0000 [ ] 74 001 0001 [ ] 75 161 00a1 [ ] 76 000 0000 [ ] 77 000 0000 [ ] 78 000 0000 [ ] 79 245 00f5 [ ] 80 003 0003 [ ] 81 000 0000 [ ] 82 000 0000 [ ] 83 002 0002 [ ] 84 000 0000 [ ] 85 000 0000 [ ] 86 000 0000 [ ] 87 000 0000 [ ] 88 039 0027 ['] <-- AU_RETURN_32_TOKEN 89 000 0000 [ ] 90 000 0000 [ ] 91 000 0000 [ ] 92 001 0001 [ ] 93 161 00a1 [ ] 94 019 0013 [ ] <-- AU_TRAILER_TOKEN 95 177 00b1 [ ] 96 005 0005 [ ] 97 000 0000 [ ] 98 000 0000 [ ] 99 000 0000 [ ] 100 119 0077 [w] -------------------------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jun 22, 2005, at 5:06 PM, Wayne Salamon wrote: (2) The AU_ATTR32_TOKEN token has a mysterious 4 byte field at the end that is not in the documentation (or shows up when using praudit). What is this field for? Can you tell me where you are seeing this extra field? In the definition of the au_attr32_t struct, and in logs I've viewed, I see the same fields as giving in the SunShield document. [NOTE: The definition I am using for the AU_ATTR32_TOKEN comes from page 86 of the SunSHIELD Basic Security Module Guide, February 2000 (5 years old!), and the definition I am using for AUE_EXECVE comes from pg. 119 of the same document. If there is more up to date documentation, please let me know.] Below is an example of an audit record for the execve(2) system call (AUE_EXECVE). First is an example output of the record from praudit. Following that is a long output of each byte of the record (first the fixed header, then the rest (or body) of the audit record). The praudit (1) shows two PATH tokens (the SunSHIELD documentation only shows one), one for the path tried and one showing the path after resolving any symbolic links, and (2) the AU_ATTR32_TOKEN (which does not show the mysterious 4 byte field!). I have augmented this output with pointers showing the beginnings of the tokens, and for the AU_ATTR32_TOKEN token I show the beginning of each field. If you drop down to the AU_ATTR32_TOKEN token you can see the fields: I don't know what that 4-byte field is at the end, but I need to read it in before I can get properly aligned for the next token. This email sent to site_archiver(a)lists.apple.com

1 0

Re: auditing in Darwin?
by Wayne Salamon 23 Jun '05

23 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Jun 22, 2005, at 1:59 PM, Todd Heberlein wrote: ------------------------ Wayne Salamon wsalamon(a)computer.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… (2) The AU_ATTR32_TOKEN token has a mysterious 4 byte field at the end that is not in the documentation (or shows up when using praudit). What is this field for? Can you tell me where you are seeing this extra field? In the definition of the au_attr32_t struct, and in logs I've viewed, I see the same fields as giving in the SunShield document. Could someone please let me know if this is the correct location for these types of questions, and if not, where (or to whom) should I direct these questions (e.g., ADC Technical Support Incident)? As Kevin pointed out, I invite you to examine the OpenBSM and TrustedBSD sites (www.trustedbsd.org and www.openbsm.org) This email sent to site_archiver(a)lists.apple.com

1 0

Re: auditing in Darwin?
by Wayne Salamon 22 Jun '05

22 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Jun 21, 2005, at 6:18 PM, Quinn wrote: At 10:43 -0700 21/6/05, Todd Heberlein wrote: Wayne ------------------------ Wayne Salamon wsalamon(a)computer.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… AFAIK the user space auditing components are in projects "bsm" and "Libc". Also, the system_cmds project contains the audit and auditd (audit daemon) components. This email sent to site_archiver(a)lists.apple.com

1 0

Re: auditing in Darwin?
by Kevin Van Vechten 22 Jun '05

22 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Jun 22, 2005, at 10:59 AM, Todd Heberlein wrote: No. However, it may be possible to with a custom kernel/kext. - Kevin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am currently processing the binary audit file (praudit is way too slow) for security forensics and intrusion detection projects, and I am using the specifications from the SunSHIELD Basic Security Module Guide and Apple's Common Criteria Configuration and Administration Guide. As I have been doing this, I have run into a number of questions and issues, and I am trying to determine where to direct these questions. Here are some examples: (1) Is it possible to have a user-level application "tap" directly into the audit data without having the data written to the disk first? (2) The AU_ATTR32_TOKEN token has a mysterious 4 byte field at the end that is not in the documentation (or shows up when using praudit). What is this field for? (3) Apple's AUE_CONNECT record (which differs from the ShunSHIELD BSM documentation) does not include the local IP address and port for AF_INET connections (e.g., TCP/IP connections). This makes it difficult to map an observed packet (e.g., one detected by a Snort sensor) to the process that created it. Why did Apple choose to drop the local address and port information from the CONNECT audit record? Can this easily be "corrected"? (4) Apple's documentation for audit records have a number of discrepancies. For example, the AUE_EXECVE record includes *two* AU_PATH_TOKEN tokens (one for the path tried and one for the actual path after resolving symbolic links) not one as specified in the SunSHIELD documentation. Who should I contact regarding the mismatch between the implementation and the documentation? Almost always, the best way is to file a bug via <http:// developer.apple.com/bugreporter/>. Could someone please let me know if this is the correct location for these types of questions, and if not, where (or to whom) should I direct these questions (e.g., ADC Technical Support Incident)? This list is appropriate, but be advised that Apple engineers on this list answer questions voluntarily on their own time. Apple shares a common BSM implementation with the TrustedBSD effort <http://www.trustedbsd.org/>. The trustedbsd-audit mailing list might be another good forum for questions 2-4. <http:// www.trustedbsd.org/mailinglists.html>. Robert Watson and Wayne Salamon are very familiar with Apple's BSM implementation. <http:// www.trustedbsd.org/developers.html>. This email sent to site_archiver(a)lists.apple.com

1 0

Re: auditing in Darwin?
by Todd Heberlein 22 Jun '05

22 Jun '05

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Jun 21, 2005, at 3:18 PM, Quinn wrote: Current Build: Mac OS X 10.3.9 (7W98), Darwin 7.9.0 Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 10:43 -0700 21/6/05, Todd Heberlein wrote: Is this auditing available in Darwin? Yes. The kernel's auditing support is built in. So, when you get the kernel source (project "xnu"), you get the auditing support as well. Great. My network connection is neither fast nor reliable, so I have been hesitant to go through the hassle of downloading the kernel code. Being able to look at the source code for auditing information now makes it worth the effort. Is this the best community for discussing internal issues of the auditing system? Well, that depends on whether these issues are related to the kernel, or the interface between the kernel and user space auditing components. If so, yes, this is the right place. OTOH, if you're just interested in the user space aspects of auditing, darwin-kernel is probably not the place you want to be. I am currently processing the binary audit file (praudit is way too slow) for security forensics and intrusion detection projects, and I am using the specifications from the SunSHIELD Basic Security Module Guide and Apple's Common Criteria Configuration and Administration Guide. As I have been doing this, I have run into a number of questions and issues, and I am trying to determine where to direct these questions. Here are some examples: (1) Is it possible to have a user-level application "tap" directly into the audit data without having the data written to the disk first? (2) The AU_ATTR32_TOKEN token has a mysterious 4 byte field at the end that is not in the documentation (or shows up when using praudit). What is this field for? (3) Apple's AUE_CONNECT record (which differs from the ShunSHIELD BSM documentation) does not include the local IP address and port for AF_INET connections (e.g., TCP/IP connections). This makes it difficult to map an observed packet (e.g., one detected by a Snort sensor) to the process that created it. Why did Apple choose to drop the local address and port information from the CONNECT audit record? Can this easily be "corrected"? (4) Apple's documentation for audit records have a number of discrepancies. For example, the AUE_EXECVE record includes *two* AU_PATH_TOKEN tokens (one for the path tried and one for the actual path after resolving symbolic links) not one as specified in the SunSHIELD documentation. Who should I contact regarding the mismatch between the implementation and the documentation? Could someone please let me know if this is the correct location for these types of questions, and if not, where (or to whom) should I direct these questions (e.g., ADC Technical Support Incident)? This email sent to site_archiver(a)lists.apple.com

1 0