January 2008 - Darwin-kernel

Re: Point me out
by John Davidorff Pell 26 Jan '08

26 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Steve Peters 26 Jan '08

26 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: improving the Seatbelt system
by Chris Adams 26 Jan '08

26 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Chris _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com On Jan 26, 2008, at 12:03 PM, Kevin Van Vechten wrote: Yes, this list is an appropriate forum. I've forwarded this to the team responsible for sandbox (I'm not sure whether they're subscribed to this list). Is there a more appropriate forum? One of the things I've been meaning to do is file an enhancement request regarding some of the available features for seatbelt but I think it would be useful to discuss some of the more complicated scenarios with a fairly wide developer audience. The main area I'm interested in is dealing with user intent — e.g. it would be really nice if there was a simple way for an application to say that it will only use the standard paths (e.g. ~/Library/ {Application Support,Preferences,Cache}/com.example.app.*) and anything which the user has selected in a standard open/save dialog, drag-and-drop, etc. which appears to be currently impossible short of creating a separate process and using IPC. smime.p7s

1 0

Re: improving the Seatbelt system
by Kevin Van Vechten 26 Jan '08

26 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi Michael, - Kevin On Jan 26, 2008, at 7:53 AM, Michael Roitzsch wrote: Hi Darwin team, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Yes, this list is an appropriate forum. I've forwarded this to the team responsible for sandbox (I'm not sure whether they're subscribed to this list). I am not sure, if this is the right place to discuss this, but it's the closest I have found. Please suggest other forums, if this is inappropriate here. I would like to suggest and discuss an enhancement to the "seatbelt" sandbox system that ships with Leopard. Currently, the sandbox seems to be merely a static system call filter. I think this already provides additional security for the processes using it and my guess is that Apple will extend this in future versions of Mac OS X. However I recently came across a technology that would in my opinion provide great benefit to seatbelt. The technology is called "model-carrying code" (MCC). The idea was published at the SOSP 2003 conference. The paper is available for download, for example here: http://seclab.cs.sunysb.edu/seclab1/pubs/papers/sosp03.pdf In a nutshell: This also implements a system call filter (that's why I think it fits seatbelt's model nicely), but instead of being a static filter, MCC provides stateful dynamic filtering. It has to be trained to capture an application's normal behavior (this could be supplemented with static code analysis) and can then be enabled to detect abnormal behavior (e.g. control flow taken over by an attacker) at runtime. It will catch more attack scenarios than a static filter. I just wanted to raise awareness of this technology amongst the Darwin hackers. Maybe someone thinks this is a nice idea. Michael Roitzsch This email sent to site_archiver(a)lists.apple.com

1 0

improving the Seatbelt system
by Michael Roitzsch 26 Jan '08

26 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi Darwin team, Michael Roitzsch _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am not sure, if this is the right place to discuss this, but it's the closest I have found. Please suggest other forums, if this is inappropriate here. I would like to suggest and discuss an enhancement to the "seatbelt" sandbox system that ships with Leopard. Currently, the sandbox seems to be merely a static system call filter. I think this already provides additional security for the processes using it and my guess is that Apple will extend this in future versions of Mac OS X. However I recently came across a technology that would in my opinion provide great benefit to seatbelt. The technology is called "model-carrying code" (MCC). The idea was published at the SOSP 2003 conference. The paper is available for download, for example here: http://seclab.cs.sunysb.edu/seclab1/pubs/papers/sosp03.pdf In a nutshell: This also implements a system call filter (that's why I think it fits seatbelt's model nicely), but instead of being a static filter, MCC provides stateful dynamic filtering. It has to be trained to capture an application's normal behavior (this could be supplemented with static code analysis) and can then be enabled to detect abnormal behavior (e.g. control flow taken over by an attacker) at runtime. It will catch more attack scenarios than a static filter. I just wanted to raise awareness of this technology amongst the Darwin hackers. Maybe someone thinks this is a nice idea. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Joe Ranieri 25 Jan '08

25 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Joe Ranieri Lead Magician, Alacatia Labs, Inc. http://alacatia.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… There's a lot of rumors about dtrace under Leopard,so could someone point me out how to compile dtrace? exnovo,i downloaded it and untar it,but i do not see any makefile or configure Thanks in advance DTrace is built into Leopard. No rumor. Nothing for you to download or build if you just want to use it. I'm assuming he's talking about the "rumor" regarding PT_DENY_ATTACH/ P_LNOATTACH and its effect on DTrace. In which case he's trying to compile dtrace for OS X, which is a pain in the ass. Basically there's a few problems -- DTrace relies on a few Apple private libraries. First off, it relies on the private Symbolication framework, which Apple provides no headers for. These can easily be gained by running 'class-dump' on the framework and then rearranging that file so it'll compile. Secondly, it relies on Scanalyzer, which appears to be a library to check if PPC functions are safe to trace. Scanalyzer doesn't have headers or even a binary file. It was linked directly into DTrace as a static library. Removing these checks appears to be safe, but I didn't actually try using the built library. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Point me out
by Garth Cummings 25 Jan '08

25 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi Cristian, On Jan 25, 2008, at 2:46 PM, cristian pancià wrote: Take a look at <x-man-page://1/dtrace> for starters. --gc ____________________________________________________________________ Garth Cummings gcummings(a)apple.com Sr. Software Engineer Apple Developer Technical Support <http://developer.apple.com/technicalsupport> _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… There's a lot of rumors about dtrace under Leopard,so could someone point me out how to compile dtrace? exnovo,i downloaded it and untar it,but i do not see any makefile or configure Thanks in advance DTrace is built into Leopard. No rumor. Nothing for you to download or build if you just want to use it. This email sent to site_archiver(a)lists.apple.com

1 0

Point me out
by cristian pancià 25 Jan '08

25 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; bh=WyDdBKxdBU4h/40/aEMf4wXlA4QeVg+POofyb2M/dAk=; b=HSSuGE8gy5uqVqERujQTHIcTNWcM3IzQazdhkhv5CMqe5hNy1cu8vTHNkEnsTtUjXCSEaMPxsb4IYJoY8sO2B948U8ShzQyHJXD4qAtNn7YTOrAR9DTCn2HM8u5vpMApBkmdTse+GyJMPcFkiN+LVvZkDWnCINP/MTn5EOXuKh0= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=CThzFKbuwAlg2oB/nhEIES94FHL8XwKW12drlAKZW1GIl915xIXHpn7Agd4CSY3wnnpXkm98NSKD/Hd6nXAt//oSruWo8T+C6NMFr/AW4gSRJRLkzyfvkQYYtUfoUvtrTKbO5K5Y1M+DKn0rgv97v7AXJdrWxQimLRpjIzhrJn0= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Panic writing kernel memory?
by Terry Lambert 25 Jan '08

25 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com exotic boot and read articles #1 and #3, and save yourself a DTS ticket. -- Terry Fantastic! Thank you all for your time! Brian On Jan 24, 2008, at 4:49 PM, Garth Cummings wrote: Hi Brian, Best, --gc On Jan 24, 2008, at 3:55 PM, Brian Doyle wrote: Hi Garth, Thanks for your reply! Thanks again everyone, Brian On Jan 24, 2008, at 2:40 PM, Garth Cummings wrote: Hey Brian, On Jan 24, 2008, at 1:39 PM, Brian Doyle wrote: Answered my own question. Hooray for having the source to the O/S. -b --gc On Jan 24, 2008, at 1:09 AM, Brian Doyle wrote: Hello, I've written a kext which, quite simply, does this: typedef void (*CFunctionPointer)(void); baz = *foo; // read ok *foo = bar; // write panic The panic log states "Memory access exception (1,0,0)". Can anyone help? I would certainly appreciate it! Thanks, Brian _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/lists%40balance-softwa… This email sent to lists(a)balance-software.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/gcummings%40apple.com ____________________________________________________________________ Garth Cummings gcummings(a)apple.com Sr. Software Engineer Apple Developer Technical Support <http://developer.apple.com/technicalsupport> _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/gcummings%40apple.com ____________________________________________________________________ Garth Cummings gcummings(a)apple.com Sr. Software Engineer Apple Developer Technical Support <http://developer.apple.com/technicalsupport> _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Or you could just go to <http://developer.apple.com>, search for the keywords: On Jan 24, 2008, at 4:58 PM, Brian Doyle wrote: Then I'll bid this thread adieu, do the homework you mentioned below and start a ticket with DTS. DTS can get you everything you're looking for except for the boot- time password prompt. This is via the Boot≠Root mechanism introduced with the Intel-based Macs and expanded to include PowerPC-based systems in Leopard. It has similarities to the scheme you cooked up but it a supported means for booting filtered HFS volumes such as AppleRAID. There is a separate developer mailing list devoted to boot-time issues, called boot-dev. It's very low traffic but the folks who deal in this space are all members. You might want to look at the slides for last year's WWDC session 112 titled "From Power On to Login: Inside the Mac OS X Leopard Boot Process." The session goes into a fair amount of detail about Boot≠Root and DTS can help you with the rest. I'm trying to boot from an encrypted partition. When the system is running, Startup Disk sees the unencrypted partition and sets the boot device to its path normally. At boot time the firmware sees the encrypted partition, can't find a BootX/boot.efi file, and of course fails to boot. My solution to this is to append a tiny HFS+ partition to the end of the device that contains a custom BootX/boot.efi file responsible for password UI, creating a decrypting block driver, decrypting the target partition, and loading the real BootX/ boot.efi file. In order to make this work, I need to intercept an NVRAM boot- device write, store the target partition and replace the write with the path to the unencrypted bootloader partition. Conversely NVRAM boot-device read needs to do a switcheroo and return the intended target path. As I mentioned, I *could* just poll / options, but that approach is horrible for (at least) two reasons, 1) that I would need to poll frequently since a boot-device write is often followed by an immediate reboot and 2) the boot-device is hardly ever changed, so we'd be wasting zillions of CPU cycles. My hack-the-vtable approach, while admittedly far from wonderful, does give me the same functionality that subclassing would. I would *LOVE* to be able to do this in some sort of approved way that would not require a bunch of maintenance down the road but I'm at a loss as to a better approach. I should mention that if any of you Apple folks think this is something DTS would be willing to help me solve I'd gladly purchase a support incident and go through that channel. In that case please send me an offline email and I'll get the ball rolling. Turns out moving bar to an IOBufferMemoryDescriptory::inTaskWithPhysicalMask() and using bcopy_phys() gets the job done. ps. - I still understand "why I shouldn't do this" but I have yet to come up with a better approach that doesn't require polling. Yeah, your approach is totally unsupported and is highly likely to break in the future. I hope this is for your own experimentation and not a commercial product. So what do you want to do when the boot device changes? Seems we should address the question from that angle in case it can lead to a hack-free solution. CFunctionPointer *foo = <some location containing a function pointer>; CFunctionPointer bar = <&some function>; CFunctionPointer baz; I'm guessing the memory I'm trying to write to has VM_PROT_WRITE disabled, but I'm not sure how to verify that (vm_region() on the address foo causes a different panic, namely a null-pointer dereference crash down in vm_map_lookup_entry()). I've noticed that when I'm two-machine debugging with gdb I can set the value *foo directly from the gdb command line with no problem. This is all well-and-good, but I need to be able to replace this function pointer from my kext. I gave vm_protect() a try but that crashed too, in the same place as vm_region(). This email sent to gcummings(a)apple.com This email sent to gcummings(a)apple.com This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to debug VM trouble?
by Terry Lambert 25 Jan '08

25 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Michael, He needs to tell us what operations. - -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jan 24, 2008, at 3:47 PM, Michael Smith wrote: On Jan 24, 2008, at 1:31 PM, Michael Crawford wrote: We were suspecting for a while that the bug was in the OS X kernel. We're going to do whatever it takes to find the real source of trouble. If it turns out that we later conclude that it is in fact in Apple's code, I'll be sure to file a bug report and post the number to this thread. If you have a reduced version of your tool that you can attach to the bug, I'm sure that will help. As a general rule, kernel memory starvation should not result in system calls that could be deferred instead returning errors, although per Rick's thread a while back on this list it is a nontrivial thing to get the right behaviour in the face of the heavy layering within the kernel. What I'm saying is that the miscompares you're seeing may well be a tool bug, but the filesystem operations returning ENOMEM feels to me like a kernel bug, and you should file accordingly. There are ~470 place, not including manual pages, where ENOMEM occurs in the kernel. There are ~300 places not involving networking, and ~60 in VFS alone. These are event sites, which means that if they are in support functions, they could each be multiplied by the functions that call them and propagate errors up, for the call graph depth. This works out to about 250 (after call amplification) places he could legitimately end up with ENOMEM because he is, in fact, out of memory (attempting to allocate from an exhaustible non-expandable zone, etc.). Michael, you need to tell us where you're getting ENOMEM from. The easiest way would be to pick the system call in user space that's giving you the ENOEM, then use DTRACE to watch it with a speculative probe, and when you get the error back at the system call return point, print out the call graph that got you the error. This will tell you where and why the ENOMEM failure is happening, which should lead you to the root cause. Actually, knowing where the error is from will probably be enough to let you actually fix the problem, without involving anyone else, I suspect. This email sent to site_archiver(a)lists.apple.com

1 0