October 2008 - Darwin-kernel

execve of /dev/null for SUID programs
by Todd Heberlein 22 Oct '08

22 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thanks, Todd Example of running the non-SUID program /tmp/my_plain: header,130,1,execve(2),0,Wed Oct 22 16:32:18 2008, + 104 msec path,/private/tmp/my_plain attribute,20173200000,heberlei,wheel,234881032,31428062411227136,0 text, subject,heberlei,heberlei,heberlei,heberlei,heberlei,1836,0,0,0.0.0.0 text, return,success,0 Example of running the SUID root program /tmp/my_suid header,118,1,execve(2),0,Wed Oct 22 16:32:24 2008, + 816 msec path,/dev/null attribute,4155400000,root,wheel,121749316,522878819082698752,50331650 text, subject,heberlei,heberlei,heberlei,heberlei,heberlei,1837,0,0,0.0.0.0 text, return,success,0 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I think I asked something similar to this for Tiger, but I think some things have changed with Leopard... When running a SUID root program, the Leopard BSM audit trail doesn't record the program's name. Instead it shows only the path /dev/null being executed. Is there a reason for this? It seems that for security reasons, you would *want* to know the name of a program running with root privilege. Below are the execve() audit records for running the exact same program. The only difference is that the second program is SUID root. Any thoughts would be appreciated. This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by Todd Heberlein 21 Oct '08

21 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Oct 20, 2008, at 7:04 PM, mm w wrote: Duh. I feel stupid. [embarrassed] Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Ho I m pretty sure :) just make some test-cases (AKA create your sleep conditions) and get the results, like this you are able to cross informations that's it This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by mm w 21 Oct '08

21 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=IbFoNOiAWn5ELLV1GH50iu3QPnRkBh9ryGbsj/JsXf4=; b=rA9aApz+xwZmo8eYNPDo4NiOzhbunHR6T/FpWckAW5ZQ0MZUK3ECCcqdF+bZxk+3IZ oaR26r6OpCYicXw16Zu6wqVWRHYHhZYkr/YuXAp5HTh2E1HQHBDFVgBctZ250Ah81LMN UJUnIjfbB1EFIMOY6uAqsscm7Ge+AVZBkrL7I= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=w/RLwwQmzzfvQcUGrzW52FDNtOKQxvxDlJVnA25DeYXb9pVFZt15nbxlDE3lxFpDLJ IzHjFC+hrJMFzavTVHp0Doj4idHY7WCJwiKXBQjFtMSYOwsunjs3kkfgmlHJ85P1tZlv Y4QZN3twgdAJUmonEfuIrVYsPSX80LNBhVAWk= Ho I m pretty sure :) just make some test-cases (AKA create your sleep conditions) and get the results, like this you are able to cross informations that's it it's what I did long time ago, it's only program logic you know, and you get what you want if my mind blocked on this kind of point, I guess, in my life, I didn't do much... Cheers! On Mon, Oct 20, 2008 at 4:52 PM, Todd Heberlein <todd_heberlein(a)mac.com> wrote: > > On Oct 20, 2008, at 1:59 PM, mm w wrote: > >> sure you don't have the explicit answer >> but with a little effort I think you could be able to figure out > > I'm not so sure. :) Here is a similar thread by Tom from a couple of days > ago, and no one posted the definitions then. > > http://forums.macosxhints.com/showthread.php?p=498768#post498768 > > If someone finds the answers, please post the answers so if someone finds > this thread on a search, they will also find the answer. > > Thanks, > > Todd > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Build AppleADBKeyboard FAILED, pbxcp: No such file or directory
by Ronnie Misra 21 Oct '08

21 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I'd try using darwinbuild: <http://darwinbuild.macosforge.org/> Ronnie On Oct 18, 2008, at 12:15 AM, 龔士捷 Gung Shi Jie wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Sat, Oct 18, 2008 at 3:05 PM, Terry Lambert <tlambert(a)apple.com> wrote: This is the ADB - Apple Destop Bus - keyboard driver, which has been obsolete for years and probably you do not have the hardware it would talk to. Current keyboards all go through USB drivers. -- Terry Thanks for your hint, so maybe I should looking for IOHIDFamily? This driver does not have and build script, could you tell me how to build it? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/rgmisra%40apple.com This email sent to rgmisra(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by Ethan Bold 21 Oct '08

21 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello- -Ethan On Oct 20, 2008, at 1:46 PM, tom(a)tpmeehan.com wrote: kernel[0]: Previous Sleep Cause: 5 Any insight to this would be greatly appreciated. Thanks. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ebold%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The number "5" is generated by a closed-source component of OS X. No one here can tell you what it means. Most of us, myself included, don't know what it means. Sorry. Typically, spontaneous sleeping problems can be caused by: thermal overheating, low capacity or aging batteries, a bad power supply on the logic board, or a number of other things. Ultimately, I'd suggest taking it to an Apple Store or mac support provider. I am trying to find out where to go to find out how to interpret the entries in system.log. For example I am trying to track down a problem concerning random sleeping with my macbook. A log entry of interest is: It must documented somewhere what the "5" means. But I don't even know who would know such a thing. So I am throwing it out to the list members. This is just one example of a log entry that would be much more helpful if I could find some documentation. This email sent to ebold(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by Todd Heberlein 20 Oct '08

20 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Oct 20, 2008, at 1:59 PM, mm w wrote: sure you don't have the explicit answer but with a little effort I think you could be able to figure out http://forums.macosxhints.com/showthread.php?p=498768#post498768 Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm not so sure. :) Here is a similar thread by Tom from a couple of days ago, and no one posted the definitions then. If someone finds the answers, please post the answers so if someone finds this thread on a search, they will also find the answer. This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by mm w 20 Oct '08

20 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=P5utoT5S6n2gLH5SdE19oQCgwuNnEGv58Mm/IEIS4NI=; b=aMoHgsbQTXRno3RUvC7V6BQ4pp2sulfvaZfb5F9Ku6ls9oZejkRR82/FMyLxk4tlc+ aHrfrmn5twwMPmFF1zAj9pCnCJ2FNXbXfBeIPem45qo33xUsI5IPhCgRWMhbwLNnPlHw vX0lTUjlMUOZoYcwhLY4g56p5MHniRfMbndSU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=rEL2lb7lNcj6rXftPjvsxka4y5bnwwKE1Ks+jqIW7BO/37kzDnx5k7cGuX++fOZ4nb v/eZWvMp2yiMIfmvtohpu6PMqXbUr2XGrFCSko4gmyTFuRvdkCqsqkKruySsAGs5AWW5 ElvoPjkQQTddEx6Qv8Oqun9LBY12PhBNUFGtY= sure you don't have the explicit answer but with a little effort I think you could be able to figure out Cheers! On Mon, Oct 20, 2008 at 1:56 PM, mm w <openspecies(a)gmail.com> wrote: > #define kIOPMClamshellSleepKey "Clamshell Sleep" > #define kIOPMPowerButtonSleepKey "Power Button Sleep" > #define kIOPMSoftwareSleepKey "Software Sleep" > #define kIOPMOSSwitchHibernationKey "OS Switch Sleep" > #define kIOPMIdleSleepKey "Idle Sleep" > #define kIOPMLowPowerSleepKey "Low Power Sleep" > #define kIOPMThermalEmergencySleepKey "Thermal Emergency Sleep" > > On Mon, Oct 20, 2008 at 1:46 PM, <tom(a)tpmeehan.com> wrote: >> I am trying to find out where to go to find out how to interpret the entries >> in system.log. >> >> For example I am trying to track down a problem concerning random sleeping >> with my macbook. A log entry of interest is: >> >> kernel[0]: Previous Sleep Cause: 5 >> >> It must documented somewhere what the "5" means. But I don't even know who >> would know such a thing. So I am throwing it out to the list members. >> >> >> This is just one example of a log entry that would be much more helpful if I >> could find some documentation. >> >> Any insight to this would be greatly appreciated. Thanks. >> >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com >> >> This email sent to openspecies(a)gmail.com >> > > > > -- > -mmw > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: sleep out of control
by mm w 20 Oct '08

20 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=EeKJw9gg0d0sL+mhYNlBeX+LKhYFQZiSW/1VReX4GjQ=; b=BxeXLjzmx/GA6+gjeo1VlUIEN6tXVkWTj9SeZ2vTptR5SD+VB6XpIRmyfHVOktQQ0l Wzl7tNaZx9UxYXSRZsF3yXq5dYmbIo5Q0X2GQKMYs371d9F/cLaEDa9x8vThlUtpfSB8 d6idhYr6BPJYt945dBmhX+BthAF2ogPi7ZjXA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=OzBfFKuDyoD3+zOtaGfujt19lwy9O5/TbRVMIjV3rl7T8NeMPBEzq1LxGgSn48viZy iM0vXLEfzzNnLBveQPr5kQ3QsWHCRZYYACuGOCFsrKUFeuC9mYOeevZJhxyVDr0HM/fv 9ApTH06fntbNYvz5T+xk9eb+yo3Sk0aqMIwAs= #define kIOPMClamshellSleepKey "Clamshell Sleep" #define kIOPMPowerButtonSleepKey "Power Button Sleep" #define kIOPMSoftwareSleepKey "Software Sleep" #define kIOPMOSSwitchHibernationKey "OS Switch Sleep" #define kIOPMIdleSleepKey "Idle Sleep" #define kIOPMLowPowerSleepKey "Low Power Sleep" #define kIOPMThermalEmergencySleepKey "Thermal Emergency Sleep" On Mon, Oct 20, 2008 at 1:46 PM, <tom(a)tpmeehan.com> wrote: > I am trying to find out where to go to find out how to interpret the entries > in system.log. > > For example I am trying to track down a problem concerning random sleeping > with my macbook. A log entry of interest is: > > kernel[0]: Previous Sleep Cause: 5 > > It must documented somewhere what the "5" means. But I don't even know who > would know such a thing. So I am throwing it out to the list members. > > > This is just one example of a log entry that would be much more helpful if I > could find some documentation. > > Any insight to this would be greatly appreciated. Thanks. > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

sleep out of control
by tom＠tpmeehan.com 20 Oct '08

20 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Internet Messaging Program (IMP) H3 (4.1.4) kernel[0]: Previous Sleep Cause: 5 Any insight to this would be greatly appreciated. Thanks. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am trying to find out where to go to find out how to interpret the entries in system.log. For example I am trying to track down a problem concerning random sleeping with my macbook. A log entry of interest is: It must documented somewhere what the "5" means. But I don't even know who would know such a thing. So I am throwing it out to the list members. This is just one example of a log entry that would be much more helpful if I could find some documentation. This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue, observing files, find who does the modification
by mm w 19 Oct '08

19 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=fyM0YeufeCNYOJajDy2cYCcQT45N9sJboj3iAdOfBS4=; b=i0S2ToWBaBroCOXfk4Pdg5Luf+c5mXZO8C/z4MxI2AFWfkNezFquyMFpprUh+XNVfM ta2wgVHmbeib+7BRw0nmL27LP3tyLrSi1lJwueVp6JQ0Syp9tFUOt92DNNx2TI3dIojp kVFqiqGBqEhUsWWIobUZNtrzK3TdY7IhEAAZ8= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=U0K2bN/h9oJYhD7qBEc7Lcjdt8rrTqTELrN7EYvSGGKPEAcV5ahbevmvC3czsyjjb2 HiEBX1clw8gB0r6SeywBj7m8JmivAnYt5EV46XkhvlGgaaHaJszbXsfGNG7ORvD27dSw XEqD0+gM0j7QUsiwIMrVe4niNJorq/Jo9jFaI= struct kevent my_kevent; int my_kq = -1; pid_t my_pid = 0; if (-1 == (my_kq = kqueue())) perror("trigger_error:kqueue"); printf("trigger:current_pid %d\n", getpid()); my_pid = fork(); if (-1 == my_pid) perror("trigger_error:fork"); else if (0 == my_pid) { perror("trigger_error:"); } else { printf("trigger:new child pid %d\n", my_pid); } my_kevent.ident = my_pid; /* identifier for this event */ my_kevent.filter = EVFILT_PROC; /* filter for event */ my_kevent.flags = EV_ADD; /* action flags for kqueue */ my_kevent.fflags = NOTE_FORK|NOTE_TRACK; /* filter flag value */ my_kevent.data = 0; /* filter data value */ my_kevent.udata = NULL; /* opaque user data identifier */ if (kevent(my_kq, &my_kevent, 0, NULL, 1, NULL) == -1) perror("trigger_error:kevent"); On Sun, Oct 19, 2008 at 3:57 AM, devmaillists <devmaillists(a)netdock.de> wrote: > Hello Terry, > thanky very much, but I have to be compatible with 10.4. So fsevent is not > an option for me (doc shows avail 10.5) > You wrote: if you monitor specific files it works > Yes I do, how does it work to get for a specific file a reference to the > modifying process? > Thanks Jürgen > On 18.10.2008, at 20:02, Terry Lambert wrote: > > On Oct 18, 2008, at 3:36 AM, devmaillists <devmaillists(a)netdock.de> wrote: > > Dear List, > I have the challenge to observe files for modification. > The difficulty is to filter on the modifing processes. > I need a way to get the PSN / PID of the modifing process / the process that > triggered the event I get in: > int event_count = kevent(kq, events_to_monitor, NUM_EVENT_SLOTS, event_data, > num_files, &timeout); > > You can't do that for arbitrary files using kevent; if you monitor specific > files it works. If you want arbitrary files, you need to use fsevent in user > space, or if you want to interpose the operation, kauth in a KEXT. If the > latter, go to <http://developer.apple.com> and look for "kauthorama". > -- Terry > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0