January 2008 - Darwin-kernel

Re: Stop the Ethernet interface from going down
by Shantonu Sen 29 Jan '08

29 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Stop the Ethernet interface from going down
by Rakesh Singhal 29 Jan '08

29 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; bh=vsUdetEtSIgUn+ZYSmv7aeld83hcr/RYKGGGWltCGaM=; b=dyl2tKOSsq6qB7je4rr9L/I6PiIX/BuwTikvLXZPjnaTbi7IZROKlWK+3hselXXqBPnWtKi22Csi3zcnhxGM9xmOgcpSw9TbNStdrNhMfFsPsGdQFpI319i53WgHzfUAp0gF8J+LfJglsFfPY3QK0jbo+IK4NN/aUwpnYKy3FzY= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=ZnjxK7/QnPHQUdvbeZbVbkPy/9PSNAQiaeopdVVupnenc1xguhzQSXwB16kFB5aAZeqCW2vpJ2k0CUgqD6bOmuSjFeNkirDXqUdgFyJ09dUsE3VlZNQMEBbaycRVipTAT4WzVM8jmIzjdLNQQVo5if/Bvqug5oSd3/BAdTYpdz4= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: improving the Seatbelt system
by Michael Roitzsch 29 Jan '08

29 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com See the following for more information on MAC: <http://www.trustedbsd.org/mac.html> <http://www.sedarwin.org/> <http://www.trustedbsd.org/> Thanks a lot for the pointers. Michael _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… MAC is all about actor, object, and action, and then controlling whether or not its allowed. It's not about policies. I understand the distinction. I did not know that the in-kernel architecture actually offers policies as plug-ins (KEXTs). This is great also from a computer scientist standpoint, because we can experiment with more elaborate policies without bothering Darwin mainline development. This email sent to site_archiver(a)lists.apple.com

1 0

Re: improving the Seatbelt system
by Terry Lambert 29 Jan '08

29 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, See the following for more information on MAC: <http://www.trustedbsd.org/mac.html> <http://www.sedarwin.org/> <http://www.trustedbsd.org/> -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jan 28, 2008, at 5:03 AM, Michael Roitzsch wrote: The main area I'm interested in is dealing with user intent - e.g. it would be really nice if there was a simple way for an application to say that it will only use the standard paths (e.g. ~/Library/{Application Support,Preferences,Cache}/ com.example.app.*) and anything which the user has selected in a standard open/save dialog, drag-and-drop, etc. which appears to be currently impossible short of creating a separate process and using IPC. Indeed. Currently there are architectural restrictions that make this sort of thing tricky. That's one of the reasons that Seatbelt is not yet considered a public API. Please /do/ file your enhancements requests; I don't think the Seatbelt folks are on this list, but I can guarantee that they will see any formal enhancement requests that you file. Thanks for the note. I will file an enhancement request then. I think a solution along the lines of model-carrying code could be a quite pragmatic solution to deal with user intent, as it should be trivial to validate a policy like the one suggested by Chris (only allow apps to write to ~/Library/Application Support/com.example.app and so on) against a syscall model of an application. Practically, internally Seatbelt uses the MAC (Mandatory Access Controls) framework (this should be obvious from DTracing seatbelted operations, and looking at the published xnu source code). MAC is the API Quinn references that's not published for third parties to use, since it's not final, and we cropped out some of the more expensive parts, at the same time adding in some control points where we though it was lacking. If you build your own kernel, you can choose to export the additional cropped-out APIs for your KEXTs, with the understanding that we reserve the right to change any of them out from under you in any release, and probably will. MAC is all about actor, object, and action, and then controlling whether or not its allowed. It's not about policies. For example, the default policy module from SEDarwin is the NSA's FLASK/TE model (but we don't include it). It can also support the MLS (Multi Level Security) policy, and the Biba integrity policy, as well as others. Seatbelt is a policy module; you could in theory experiment with your own policy that implements your ideas (within the constraints of the MAC chokepoints we implemented). This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Rick Macklem 28 Jan '08

28 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Mon, 28 Jan 2008, cristian panci? wrote: Sorry but being a very newbie with Xcode,and the programmations,having build the kext stuff,how can i put in one directory and than Kextload dtrace.kext,from the Xcode programm thanks to all of you pointing me almost out If you go to developer.apple.com, you should be able to find a document called Kernel Extension Concepts. Look at it, starting at pg 24. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com Good luck with it, rick

1 0

Re: improving the Seatbelt system
by Michael Roitzsch 28 Jan '08

28 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Michael _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The main area I'm interested in is dealing with user intent - e.g. it would be really nice if there was a simple way for an application to say that it will only use the standard paths (e.g. ~/ Library/{Application Support,Preferences,Cache}/com.example.app.*) and anything which the user has selected in a standard open/save dialog, drag-and-drop, etc. which appears to be currently impossible short of creating a separate process and using IPC. Indeed. Currently there are architectural restrictions that make this sort of thing tricky. That's one of the reasons that Seatbelt is not yet considered a public API. Please /do/ file your enhancements requests; I don't think the Seatbelt folks are on this list, but I can guarantee that they will see any formal enhancement requests that you file. Thanks for the note. I will file an enhancement request then. I think a solution along the lines of model-carrying code could be a quite pragmatic solution to deal with user intent, as it should be trivial to validate a policy like the one suggested by Chris (only allow apps to write to ~/Library/Application Support/com.example.app and so on) against a syscall model of an application. This email sent to site_archiver(a)lists.apple.com

1 0

Re: improving the Seatbelt system
by Quinn 28 Jan '08

28 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/bugreporter/> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 13:31 -0800 26/1/08, Chris Adams wrote: One of the things I've been meaning to do is file an enhancement request regarding some of the available features for seatbelt but I think it would be useful to discuss some of the more complicated scenarios with a fairly wide developer audience. The main area I'm interested in is dealing with user intent - e.g. it would be really nice if there was a simple way for an application to say that it will only use the standard paths (e.g. ~/Library/{Application Support,Preferences,Cache}/com.example.app.*) and anything which the user has selected in a standard open/save dialog, drag-and-drop, etc. which appears to be currently impossible short of creating a separate process and using IPC. Indeed. Currently there are architectural restrictions that make this sort of thing tricky. That's one of the reasons that Seatbelt is not yet considered a public API. Please /do/ file your enhancements requests; I don't think the Seatbelt folks are on this list, but I can guarantee that they will see any formal enhancement requests that you file. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by cristian pancià 28 Jan '08

28 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; bh=kCB0ceBYs2OyPpuSdDRZ1QiSRN/qSpwM5pmywRGVS/c=; b=pkrwdvwK6ZaD1ldGARLVlhSiLiveb7DLWpD2zh9dkIyPDE63USgIkvY2ikSNUAtBS1puUU3aomQiVI9auwx96fQgbuhk2wO143GcdGMADD3xSDM9lhHjixEG/luNLAdW5iBFoWyMWmzUYMx3RFogIWNazly1NLd9wyjSYAhsa0Q= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=DC8FCxGHFI70EhX8sNmgUmrgA78340fM59qoXru2r6DUna7S8/O+xQld9Keezwo3PimzXINsHTGmxkB3YnDHaCBGz0N+jErRjkszLWrNN2fRBgiPo6qiMz0jv68OqV7NtTyqzdE/6KiSc0J7YvvEEWq81/lGeRebojE9rBqvV8I= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Joe Ranieri 27 Jan '08

27 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Joe Ranieri Lead Magician, Alacatia Labs, Inc. http://alacatia.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Errr, I expect what he wants to do is build (or rework) the *kernel* side of DTrace -- that's part of the "xnu" project (and is the place where P_LNOATTACH "lives"). The kernel build relies neither on the userland Symbolication framework nor on the Scanalyzer. From the top of the xnu project, Well, that would have been a good thing to check before I messed around with building DTrace. Sigh. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Kevin Van Vechten 27 Jan '08

27 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://trac.macosforge.org/projects/darwinbuild> <http://svn.macosforge.org/repository/darwinbuild/trunk/README> ... $ darwinbuild -init 9A581 $ darwinbuild xnu - Kevin On Jan 26, 2008, at 3:45 PM, John Davidorff Pell wrote: JP On 26 Jan 2008, at 15:33, Steve Peters wrote: Date: Fri, 25 Jan 2008 18:33:46 -0500 From: Joe Ranieri <joe(a)alacatialabs.com> Subject: Re: Point me out To: darwin-kernel(a)lists.apple.com Message-ID: <AF51465C-689F-473B-A6E4-FC0A92FD8FCF(a)alacatialabs.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes DTrace is built into Leopard. No rumor. Nothing for you to download or build if you just want to use it. % make ARCH_CONFIGS="PPC I386" exporthdrs all SCP -- Steve Peters scp(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/apple_lists%40gaelicwi… _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/kvv%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The DarwinBuild project assists with building Darwin projects. It can be used to compile xnu for Leopard. It would probably be easier to just get the kext which has been floating around which patches the PT_DENY_ATTACH thing... On Jan 26, 2008, at 12:04 PM, darwin-kernel-request(a)lists.apple.com wrote: There's a lot of rumors about dtrace under Leopard,so could someone point me out how to compile dtrace? exnovo,i downloaded it and untar it,but i do not see any makefile or configure Thanks in advance I'm assuming he's talking about the "rumor" regarding PT_DENY_ATTACH/ P_LNOATTACH and its effect on DTrace. In which case he's trying to compile dtrace for OS X, which is a pain in the ass. Basically there's a few problems -- DTrace relies on a few Apple private libraries. Errr, I expect what he wants to do is build (or rework) the *kernel* side of DTrace -- that's part of the "xnu" project (and is the place where P_LNOATTACH "lives"). The kernel build relies neither on the userland Symbolication framework nor on the Scanalyzer. From the top of the xnu project, will kick off the kernel build. See the archives of this list for further instructions, or the README, or Google ... This email sent to apple_lists(a)gaelicwizard.net This email sent to kvv(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0