May 2006 - Darwin-kernel - lists.apple.com

Re: software firewall wishlist (pf, but see systrace, which was a good idea, too)
by Christopher D. Lewis 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=KOK7Htb80Tk8MEiPgj5mgC3ZffLx2C7N1Fdsxy3Y9GTlZUekLSzvGNbKxz0LS02X; h=Received:Mime-Version:In-Reply-To:References:Content-Type:Message-Id:Content-Transfer-Encoding:From:Subject:Date:To:X-Mailer:X-ELNK-Trace:X-Originating-IP; Hi, I wish pf or ipfilter be ported to darwin so we will have choices for better firewalls (ipfw, pf, ipf) You might want to try "man ipfw"; you are running Tiger, right? 8-). Any thoughts? Many thanks, Chris _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 3, 2006, at 10:12 PM, Terry Lambert wrote: On Apr 1, 2006, at 12:52 AM, Jett Tayer wrote: OT: ipfilter now runs on linux For pf and ipfilter, either one could be ported as an NKE (Network Kernel Extension) pretty trivially, and Apple provides NKE sample code already. To get all the things the pf tools support (including firewall failover, load balancing, packet prioritization, per-user port access privileges, network address translation, and the like) there's a host of userland stuff that'd need porting (and the .kext would need to create pf's virtual devices, so userland apps could interact with the firewall as the developers intended). (Note that pf does both NAT and packet filtering, so the pf port would involve more than the firewall's .kext and userland, it would involve removing the stuff that collides with pf's other functions.) FreeBSD has a pf port, and pf has apparently been part of the FreeBSD 5.x tree since sometime in 2004, though I don't know the size of it's user base. The fact that pf is under active development, has actual analysis of packet numbers rather than brainless trust of packet flags as its indicator of existing states, and supports things like fail-over make it very attractive for people who really want to run firewalls (e.g., need extremely large bandwidth filtered reliably and without losing either protection or connection during upgrades). The fact that the tools are being ported to FreeBSD suggest a more likely route of entry to the Darwin code base than requesting a port directly to Darwin, given the last response to inquiries about Darwin's firewall and its possible replacements. For pf see http://www.openbsd.org/faq/pf/ index.html Note that pf allows (via authpf) exposure of different firewall rules to different users, which is a great way to expose intranet assets to traveling members of an organization; simply require users to authenticate by remote login and presto, they get access to ports that give the restricted material. If you don't like your server logs filling with attacks, firewall everybody who can't authenticate on port 22 and your server will be saved the overhead of establishing SSL sessions with attackers. >From my reading on the relative (de)merits of various firewalls, my favorite champion for a robust and administrator-friendly firewall solution is pf. Quite aside from the actual behavior of the various solutions out there, pf has the added advantages of (a) a BSD license and (b) introduction into a code tree from which Darwin periodically obtains updates anyway. If pf can be made part of the code import, it will be a bit more future proof than some of the lost security improvements such as Systrace. The history of Systrace (which in an earlier version of Darwin allowed fine-grained privilege control, privilege escalation, etc.; trojans would have a hard time screwing with a system running such an environment; alas, Apple's compile didn't include this Darwin code) in the Darwin kernel is a sad one. Systrace was not part of a code base Apple could update from FreBSD and thus died from nonsupport when its creator lost access to a machine that ran Apple's operating system. Also, nobody at Apple seemed to "get" what it did or why it was good for the average user (heck, the onboard firewall is shipped off by default too; people enable and configure at their own peril). Without actually trying systrace, some folks alleged on this list that it would make their machines unusable by Grandma (which is why the firewall ships off by default, no?). Screen shots of iTunes running under Systrace http://www.citi.umich.edu/u/provos/systrace/ macosx.html indicate both that a GUI front-end can offer user- friendly management and that "traditional" MacOS apps can work just fine under Systrace (while being barred from doing anything not allowed, and without requiring the application to be re-written to take advantage of fine-grained capabilities; imagine running a system without needing setuid apps and other security risks, eh? And what a way to cage Trojans without needing jails, eh?). While I'm talking up Systrace, it's worth pointing out that applications' installation frequently requires users to enter admin passwords but don't provide much help in determining what behavior will follow the entry of the password; having installation reveal the vendor- suggested systrace policy requested by the installed app would significantly improve users' understanding of what the app plans to do (e.g., a MSFT word processor that opens network ports at launch, etc.). An admin tool like Systrace, even if like the firewall is shipped in a passive state, would give users with security concerns a real advantage. MacOS X may not have viruses, but protection against Trojans would be great, eh? And developing systrace policies can be done by a userland program that watches the system calls target apps make. http://www.onlamp.com/pub/a/bsd/2003/02/27/ Big_Scary_Daemons.html I'd like to ship the developer a machine from which to revitalize the systrace code, but I'm concerned that his work may be ignored. But I digress. In short, fine-grained privilege management and privilege escalation and so on may be more readily available through Systrace than it may down the road from TrustedBSD; and systrace, because it doesn't require applications to know about the kernel's policies, won't break apps that outlive a particular version of systrace. Since apps don't need to know about Systrace for the system to benefit from systrace when running the apps, it adds no burden on third-party developers (unless they want to ship proposed systrace policies for the convenience of folks who activate it). Where is the place to ask what sort of support would be needed for a security technology like this to be included in Darwin as something Apple actually compiles, and not merely tolerates sitting unused in the Darwin code tree? Sorry about the length. The original answer seemed to make it sound like a pf port would be a .kext project, when it's a carefully integrated system of kernel and userland tools that offer functionality that includes functionality of projects larger than those of the packet filter one would replace. The real question seems to be, if security improvements were offered to Apple would Apple ignore them or now? The pf code (kernel and userland) is in use in FreeBSD and available now; if someone took the time to package it up for Darwin would it even be accepted? Would it be treated like Systrace and ignored? Does Apple's evolving interest in security change its previously-likely behavior? (e.g., its previous hostility to the very idea developers in the BSD community would bother to make *another* firewall, and *why* would anybody so waste their time? Literally, that was emailed to me from an address @apple.com) I'd like to see improvements to Darwin (for desktop and for server environments) but I'm hesitant now to give real support to efforts to provide code. This email sent to site_archiver(a)lists.apple.com

1 0

Re: NKE and Kauth credentials... (Re: kauth_getuid returns 0?)
by Josh Graessley 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -josh On May 17, 2006, at 10:26 AM, Russ Seehafer wrote: Let me elaborate on what I am actually trying to accomplish: Here is the question: My nke is based on the tcplognke sample. Thanks, Russ On May 16, 2006, at 10:14 PM, Michael Smith wrote: Russ, = Mike On May 16, 2006, at 4:59 PM, Russ Seehafer wrote: Thanks, Russ On May 12, 2006, at 9:06 PM, Terry Lambert wrote: To elaborate on what Brian said. -- Terry On May 11, 2006, at 8:30 PM, Brian Bergstrand wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On May 11, 2006, at 9:28 PM, Russell Seehafer (RIT Student) wrote: Hi, Thanks! Russ HTH. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFEZAFTedHYW7bHtqIRAv2XAJ9Gny13NuUFYFNx0BSHsLXXC8NshQCg1mrF /VozuSFlTTBia/GT0p26xis= =4446 -----END PGP SIGNATURE----- This email sent to drivers(a)mu.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com You can not determine with confidence from the nke the uid of the user that owns the process that initiated the network traffic. You can make some guesses, but you will be wrong. On solution is to create a socket filter and get the current process when the socket was created. This covers most cases, but it won't cover cases where a new socket is created to handle an inbound connection to a listening socket. This also doesn't work when the socket is one created by the kernel. Network filesystems present a unique challenge. They create sockets in the kernel on behalf of the user. Most mounted network filesystem can be accessed by anyone on the system, so it may not be right to associate that socket with any specific user or session. launchd/inetd present another challenge. The listening socket is created in that process and the inbound connections are shared with another process. There are other cases where sockets are shared among processes. The most common case I can think of is a helper tool that is run privileged to setup a socket and pass it back to a process that is not privileged. My application starts exactly once for each mac user account on a given computer. This user space application communicates with the nke via a control socket. In the case of fast user switching the nke needs to associate network traffic initiated by applications running in a specific user's account with the instance of my application running under that user's account. How do I determine with confidence (from within the nke) the uid of the user that owns the process that initiated the network traffic? It is not safe to assume that the UID in force when a descriptor (socket) is created is the same UID that will be applicable to all operations on that socket. If it matters to you on a per-operation basis who is performing the operation, then it is necessary for you to work out how to get hold of the caller's identity. Thanks for your input, this makes a lot of sense now. In the tcplognke sample, the tcplognke.c file has a method named tl_attach_fn that makes a call to kauth_getuid(). Is it safe to assume that when the socket filter is being attached and the call to tl_attach_fn is made that this specific call to kauth_getuid() will return the correct user id (of the associated user-space process)? If that is the case I think I can solve my problem by storing the kauth_getuid() value and referencing throughout the rest of the nke as needed. kauth_getuid() returns the UID of the currently running thread, if there is one. Otherwise it returns the uid of the currently running process. In practice, there are a number of cases where operations are enqueued into a work queue for later operation. In general, if the credential is important, then a reference is enqueued as part of the metadata on the operation being performed. This is then used as the credential by the proxy operation. The credential you should use in your code depends on whether the operation is occurring in a proxy context, or it's occurring in the real context - in other words, if you are being called into from a worker thread, it's likely you are being passed a credential as one of your arguments, or as part of the metadata for the work item in scope at the time of the call, and there will either be an accessor function for this, or (worst case) the structure internals will be visible and you can dereference to get it yourself. In other words, blindly calling kauth_getuid() is not necessarily the right thing to do in all cases. For an NKE, in general, work will come in on a worker thread when being pushed up the TCP stack, and the credential you will want to use for the operation is based on the process associated with the socket to which the data is destined, not the currently running thread. Most likely you are either not using this information, or you don't have the information in scope because you are trying to perform your operation at the wrong layer. If you need more help, some of the networking guys read this list, but you will likely need to tell them more about what you are doing and when (what's getting hooked, what you are trying to accomplish, etc.) for them to help you. If this information is sensitive, and not suitable for a public list, you should probably work through bugreporter or DTS. I have a nke that keeps track of its associated user space clients based on the value returned from kauth_getuid() I have run into some instances where this call returns 0. I cannot find any documentation on this method does anyone have any idea what could be causing this call to return 0? My understanding is that if a packet is being transmitted by safari, for example, that kauth_getuid() would return the user's id of the user that is running safari. Is there more I should consider when using this method? 0 is a valid UID. It is the UID of the root user. 0 could also be returned because there is no current task at the point you call kauth_getuid() so you are getting the root user by default (ie the kernel task). _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/drivers% 40mu.org This email sent to jgraessley(a)apple.com smime.p7s

1 0

Re: NKE and Kauth credentials... (Re: kauth_getuid returns 0?)
by Russ Seehafer 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer:sender; b=ZYlSEA4gwISM3jFJktFgT/Up2AVIbwSUvNj82yEHqe8sg6drjNKGRlwjyNrZvoXiDgaDYJqdKQYzRjelV03rFSFFwajQjdYEOm7+Qdp0HnePrqETL9ybV3wNU4SpKLztbsCSrUAs2mn0eSKzDyJVzas9HyuN8PEgN8VDNDhZpjc= On May 17, 2006, at 1:41 PM, Michael Smith wrote: On May 17, 2006, at 10:26 AM, Russ Seehafer wrote: Let me elaborate on what I am actually trying to accomplish: Here is the question: = Mike I suppose my first statement below was incorrect: Thanks again for all of your input. -Russ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… My application starts exactly once for each mac user account on a given computer. This user space application communicates with the nke via a control socket. In the case of fast user switching the nke needs to associate network traffic initiated by applications running in a specific user's account with the instance of my application running under that user's account. How do I determine with confidence (from within the nke) the uid of the user that owns the process that initiated the network traffic? You need to get this from the socket. Sadly, this isn't something you can do with the KPI as far as I know - you'll want to ask one of the networking folks that posts/reads here on a regular basis (I copied Vincent) about how they recommend you get a copy of the credential that ought to be associated with the socket at creation time. This is what you should use to obtain the user ID. Note, however, that user ID is not the same thing as login session ID. It is perfectly legal to have more than one session owned by the same user; perhaps you need to rethink your architecture? What are you really trying to achieve? The credential contains other information that can be used to uniquely identify the session; it may be this that you need. My application starts exactly once for each mac user account on a given computer. It starts exactly once per login session. I could easily use the session ID instead - as long as this is available. My question is simply how to obtain this from within the nke. This email sent to site_archiver(a)lists.apple.com

1 0

Re: NKE and Kauth credentials... (Re: kauth_getuid returns 0?)
by Michael Smith 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On May 17, 2006, at 10:26 AM, Russ Seehafer wrote: Let me elaborate on what I am actually trying to accomplish: Here is the question: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… My application starts exactly once for each mac user account on a given computer. This user space application communicates with the nke via a control socket. In the case of fast user switching the nke needs to associate network traffic initiated by applications running in a specific user's account with the instance of my application running under that user's account. How do I determine with confidence (from within the nke) the uid of the user that owns the process that initiated the network traffic? You need to get this from the socket. Sadly, this isn't something you can do with the KPI as far as I know - you'll want to ask one of the networking folks that posts/reads here on a regular basis (I copied Vincent) about how they recommend you get a copy of the credential that ought to be associated with the socket at creation time. This is what you should use to obtain the user ID. Note, however, that user ID is not the same thing as login session ID. It is perfectly legal to have more than one session owned by the same user; perhaps you need to rethink your architecture? What are you really trying to achieve? The credential contains other information that can be used to uniquely identify the session; it may be this that you need. This email sent to site_archiver(a)lists.apple.com

1 0

NKE and Kauth credentials... (Re: kauth_getuid returns 0?)
by Russ Seehafer 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:mime-version:content-transfer-encoding:message-id:content-type:to:from:subject:date:x-mailer:sender; b=JDvufojTIhJPmfef2rBfhrge8drGz7QeX4wyH0orW6LcZYAa1GZiKP4oOcmnluDflQ6kzbsoTKAey+H01yp4Z43ruhfMxRU3g5UPGVqZMYVNNhq6AW69j81qS3HqgmrG3RoKjw1IOko2jxIoFo8LIjCLjDzP1v1Ltxj/J1u7jlA= Let me elaborate on what I am actually trying to accomplish: Here is the question: My nke is based on the tcplognke sample. Thanks, Russ On May 16, 2006, at 10:14 PM, Michael Smith wrote: Russ, = Mike On May 16, 2006, at 4:59 PM, Russ Seehafer wrote: Thanks, Russ On May 12, 2006, at 9:06 PM, Terry Lambert wrote: To elaborate on what Brian said. -- Terry On May 11, 2006, at 8:30 PM, Brian Bergstrand wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On May 11, 2006, at 9:28 PM, Russell Seehafer (RIT Student) wrote: Hi, Thanks! Russ HTH. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFEZAFTedHYW7bHtqIRAv2XAJ9Gny13NuUFYFNx0BSHsLXXC8NshQCg1mrF /VozuSFlTTBia/GT0p26xis= =4446 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/drivers%40mu.org This email sent to drivers(a)mu.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… My application starts exactly once for each mac user account on a given computer. This user space application communicates with the nke via a control socket. In the case of fast user switching the nke needs to associate network traffic initiated by applications running in a specific user's account with the instance of my application running under that user's account. How do I determine with confidence (from within the nke) the uid of the user that owns the process that initiated the network traffic? It is not safe to assume that the UID in force when a descriptor (socket) is created is the same UID that will be applicable to all operations on that socket. If it matters to you on a per-operation basis who is performing the operation, then it is necessary for you to work out how to get hold of the caller's identity. Thanks for your input, this makes a lot of sense now. In the tcplognke sample, the tcplognke.c file has a method named tl_attach_fn that makes a call to kauth_getuid(). Is it safe to assume that when the socket filter is being attached and the call to tl_attach_fn is made that this specific call to kauth_getuid() will return the correct user id (of the associated user-space process)? If that is the case I think I can solve my problem by storing the kauth_getuid() value and referencing throughout the rest of the nke as needed. kauth_getuid() returns the UID of the currently running thread, if there is one. Otherwise it returns the uid of the currently running process. In practice, there are a number of cases where operations are enqueued into a work queue for later operation. In general, if the credential is important, then a reference is enqueued as part of the metadata on the operation being performed. This is then used as the credential by the proxy operation. The credential you should use in your code depends on whether the operation is occurring in a proxy context, or it's occurring in the real context - in other words, if you are being called into from a worker thread, it's likely you are being passed a credential as one of your arguments, or as part of the metadata for the work item in scope at the time of the call, and there will either be an accessor function for this, or (worst case) the structure internals will be visible and you can dereference to get it yourself. In other words, blindly calling kauth_getuid() is not necessarily the right thing to do in all cases. For an NKE, in general, work will come in on a worker thread when being pushed up the TCP stack, and the credential you will want to use for the operation is based on the process associated with the socket to which the data is destined, not the currently running thread. Most likely you are either not using this information, or you don't have the information in scope because you are trying to perform your operation at the wrong layer. If you need more help, some of the networking guys read this list, but you will likely need to tell them more about what you are doing and when (what's getting hooked, what you are trying to accomplish, etc.) for them to help you. If this information is sensitive, and not suitable for a public list, you should probably work through bugreporter or DTS. I have a nke that keeps track of its associated user space clients based on the value returned from kauth_getuid() I have run into some instances where this call returns 0. I cannot find any documentation on this method does anyone have any idea what could be causing this call to return 0? My understanding is that if a packet is being transmitted by safari, for example, that kauth_getuid() would return the user's id of the user that is running safari. Is there more I should consider when using this method? 0 is a valid UID. It is the UID of the root user. 0 could also be returned because there is no current task at the point you call kauth_getuid() so you are getting the root user by default (ie the kernel task). This email sent to site_archiver(a)lists.apple.com

1 0

Re: newer darwin version than with OSX 10.4.6?
by Brian Bechtel 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=cnZc1iADDibsb5l8gStnkXi6XWNSGqVIHejFYZaAs3waWI7jIYKQj0EHVy4j1er0je9YhfJNnOnbgYAotRd96UJAv19VgCif1H60UkAJPnBhCRcZz53/GL5BYaYefc6yxuDbzFxn2u1Z5S3I8jlP/Uifzbg1pmE08EUG/MdGVvQ= http://www.opensource.apple.com/darwinsource/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 5/17/06, thomasoft <thomasoft(a)ggs.ch> wrote: where can the newest code of darwin for ppc be found? This email sent to site_archiver(a)lists.apple.com

1 0

newer darwin version than with OSX 10.4.6?
by thomasoft 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com hi there where can the newest code of darwin for ppc be found? does a website exist? or do all coders only send the sourcecode back to apple? and apple will then release newer versions? i'm asking because i'm not satisfied with the speed of osx...i think it's the mach kernel which is quite slow...do newer, i.e faster versions optimized for example for the g5 exist? kindly regards marco thoma ____________________________________________ QuickLine WebMail - http://www.QuickLine.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kauth
by Jérome Foucher 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Le 16 mai 06 à 22:00, Terry Lambert a écrit : Bug ID 4550944 Thanks, Jérome _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… More annoying, if I do not call "kextunload KauthORama" and shutdown my Mac, I get a kernel panic (each time, and this happened on all the machines I've tested). I checked the code a few times and could not find a bug in it that coulw cause a kernel panic. Please file a bug via Bugreporter <http://developer.apple.com/ bugreporter/>. Include the stack traceback and other information from having set the debug flags, so that it's possible to tell where things are crashing. Als indicate if the code is the stock Apple sample code, or if you have modified it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kauth_getuid returns 0?
by Michael Smith 17 May '06

17 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Russ, = Mike On May 16, 2006, at 4:59 PM, Russ Seehafer wrote: Thanks, Russ On May 12, 2006, at 9:06 PM, Terry Lambert wrote: To elaborate on what Brian said. -- Terry On May 11, 2006, at 8:30 PM, Brian Bergstrand wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On May 11, 2006, at 9:28 PM, Russell Seehafer (RIT Student) wrote: Hi, Thanks! Russ HTH. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFEZAFTedHYW7bHtqIRAv2XAJ9Gny13NuUFYFNx0BSHsLXXC8NshQCg1mrF /VozuSFlTTBia/GT0p26xis= =4446 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/drivers%40mu.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… It is not safe to assume that the UID in force when a descriptor (socket) is created is the same UID that will be applicable to all operations on that socket. If it matters to you on a per-operation basis who is performing the operation, then it is necessary for you to work out how to get hold of the caller's identity. Thanks for your input, this makes a lot of sense now. In the tcplognke sample, the tcplognke.c file has a method named tl_attach_fn that makes a call to kauth_getuid(). Is it safe to assume that when the socket filter is being attached and the call to tl_attach_fn is made that this specific call to kauth_getuid() will return the correct user id (of the associated user-space process)? If that is the case I think I can solve my problem by storing the kauth_getuid() value and referencing throughout the rest of the nke as needed. kauth_getuid() returns the UID of the currently running thread, if there is one. Otherwise it returns the uid of the currently running process. In practice, there are a number of cases where operations are enqueued into a work queue for later operation. In general, if the credential is important, then a reference is enqueued as part of the metadata on the operation being performed. This is then used as the credential by the proxy operation. The credential you should use in your code depends on whether the operation is occurring in a proxy context, or it's occurring in the real context - in other words, if you are being called into from a worker thread, it's likely you are being passed a credential as one of your arguments, or as part of the metadata for the work item in scope at the time of the call, and there will either be an accessor function for this, or (worst case) the structure internals will be visible and you can dereference to get it yourself. In other words, blindly calling kauth_getuid() is not necessarily the right thing to do in all cases. For an NKE, in general, work will come in on a worker thread when being pushed up the TCP stack, and the credential you will want to use for the operation is based on the process associated with the socket to which the data is destined, not the currently running thread. Most likely you are either not using this information, or you don't have the information in scope because you are trying to perform your operation at the wrong layer. If you need more help, some of the networking guys read this list, but you will likely need to tell them more about what you are doing and when (what's getting hooked, what you are trying to accomplish, etc.) for them to help you. If this information is sensitive, and not suitable for a public list, you should probably work through bugreporter or DTS. I have a nke that keeps track of its associated user space clients based on the value returned from kauth_getuid() I have run into some instances where this call returns 0. I cannot find any documentation on this method does anyone have any idea what could be causing this call to return 0? My understanding is that if a packet is being transmitted by safari, for example, that kauth_getuid() would return the user's id of the user that is running safari. Is there more I should consider when using this method? 0 is a valid UID. It is the UID of the root user. 0 could also be returned because there is no current task at the point you call kauth_getuid() so you are getting the root user by default (ie the kernel task). This email sent to drivers(a)mu.org This email sent to site_archiver(a)lists.apple.com

1 0

Re: kauth_getuid returns 0?
by Russ Seehafer 16 May '06

16 May '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer:sender; b=S6vvEjaYTjiNyDNhkJzyD3CGMuxTYG9aVeNY6x4wPskdftEFd6kTdin3eUfkwFgQ/SemIDbqaGb27vrOmDDT+9AqXipJNqDJCn+o72s+kegAJXrMK4ToAlEvijtLqfeWqwX+wiHJ6qmrkNHI/5q654lCzOUn9G9yBhB4wolajTg= Thanks, Russ On May 12, 2006, at 9:06 PM, Terry Lambert wrote: To elaborate on what Brian said. -- Terry On May 11, 2006, at 8:30 PM, Brian Bergstrand wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On May 11, 2006, at 9:28 PM, Russell Seehafer (RIT Student) wrote: Hi, Thanks! Russ HTH. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFEZAFTedHYW7bHtqIRAv2XAJ9Gny13NuUFYFNx0BSHsLXXC8NshQCg1mrF /VozuSFlTTBia/GT0p26xis= =4446 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks for your input, this makes a lot of sense now. In the tcplognke sample, the tcplognke.c file has a method named tl_attach_fn that makes a call to kauth_getuid(). Is it safe to assume that when the socket filter is being attached and the call to tl_attach_fn is made that this specific call to kauth_getuid() will return the correct user id (of the associated user-space process)? If that is the case I think I can solve my problem by storing the kauth_getuid() value and referencing throughout the rest of the nke as needed. kauth_getuid() returns the UID of the currently running thread, if there is one. Otherwise it returns the uid of the currently running process. In practice, there are a number of cases where operations are enqueued into a work queue for later operation. In general, if the credential is important, then a reference is enqueued as part of the metadata on the operation being performed. This is then used as the credential by the proxy operation. The credential you should use in your code depends on whether the operation is occurring in a proxy context, or it's occurring in the real context - in other words, if you are being called into from a worker thread, it's likely you are being passed a credential as one of your arguments, or as part of the metadata for the work item in scope at the time of the call, and there will either be an accessor function for this, or (worst case) the structure internals will be visible and you can dereference to get it yourself. In other words, blindly calling kauth_getuid() is not necessarily the right thing to do in all cases. For an NKE, in general, work will come in on a worker thread when being pushed up the TCP stack, and the credential you will want to use for the operation is based on the process associated with the socket to which the data is destined, not the currently running thread. Most likely you are either not using this information, or you don't have the information in scope because you are trying to perform your operation at the wrong layer. If you need more help, some of the networking guys read this list, but you will likely need to tell them more about what you are doing and when (what's getting hooked, what you are trying to accomplish, etc.) for them to help you. If this information is sensitive, and not suitable for a public list, you should probably work through bugreporter or DTS. I have a nke that keeps track of its associated user space clients based on the value returned from kauth_getuid() I have run into some instances where this call returns 0. I cannot find any documentation on this method does anyone have any idea what could be causing this call to return 0? My understanding is that if a packet is being transmitted by safari, for example, that kauth_getuid() would return the user's id of the user that is running safari. Is there more I should consider when using this method? 0 is a valid UID. It is the UID of the root user. 0 could also be returned because there is no current task at the point you call kauth_getuid() so you are getting the root user by default (ie the kernel task). This email sent to site_archiver(a)lists.apple.com

1 0