October 2008 - Darwin-kernel

key remapper
by Robert Nikander 14 Oct '08

14 Oct '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Hi, thanks, Rob _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm trying to write a kernel extension that remaps certain keys for a certain application. (Specifically, I want to switch Command and Option in Terminal.app. The system preferences let you do this, but only for all applications.) I haven't written kernel extensions before. I've got one working that can remap keys for all applications. I did this by putting new functions in the _keyboardEventAction fields in the IOHIKeyboard objects. The new function changes the arguments before passing them through to the original _keyboardEventAction. Now, the missing piece... how can I find out which application is in the foreground? This email sent to site_archiver(a)lists.apple.com

1 0

Re: map of system call to tar ball file?
by Terry Lambert 14 Oct '08

14 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You could buy Amit Singh's "Mac OS X Internals" book and read it... -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Oct 13, 2008, at 2:20 PM, Todd Heberlein wrote: OK, I found open() in Libc-498.1.1, but it just calls __open_nocancel(). Any idea where I can find this function? And back to the original question, is there an easy way to find where these functions might be so I don't have to ask? In Mac OS X, the system call API is at the top of libSystem. This differs frm many other UNIX implementations, which place their system call API at the user/kernel boundary, without intermediation by a shared library. The purpose of this is to allow modification of kernel interfaces and changes to the contract between kernel and user space, while maintaining binary compatibility with historical applications. LibSystem is a pseduo-project which aggregates a number of library projects into a single library called libSystem (currently, /usr/lib/ libSystem.B.dylib). It gets its pieces from a large number of places, which are documented in the pseduo-project itself, and which include, but are not limited to, libsyscall, libc, libnotify, libm, and others. Section 2 (manual page section) calls are implemented in either Libc, if there is logic or compatibility code required, or they are implemented in libsyscall. The libsyscall implementation itself is another pseduo-project which utilizs souzrce code from the xnu project in the libsyscall subdirectory, which in turn utilizes code and build products from building xnu itself (xnu is the kernel project). For libsyscall, the normal approach is to use perl to post-process the file xnu/bsd/kern/syscalls.master in order to generate system call stub functions for those system calls which do not have wrapper functions in Libc. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Register a task's exception port from a kext
by nicolas vide 14 Oct '08

14 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=Pk7a3zwckOA7SqfWjgz4VahhuvglM5T7j4yPNzrkEls=; b=BZHsfsLNntfCKGiFaBl3x/v2VPSMwHOXA2s7xtiU++A7XKUAkIEINBzPHnkb/bKYcp 98G27tKBB2PkwCdPxrsKsS/taCbdwU9JE7kk3HnNp0ypRfVoV3L6AOHyBLD157kl03tz 6FuQqfu1ZsjvKqGATIKqkLpY72bHPncROpE6k= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=GX75lYf70H7zrmwW+rqgooPKCN+uKtygp9Z6HzwbklNhO+mlU7BX50LFzlOX7GaWt3 12/0vfOhqeZuKDrBoyYAXPef9s2Y8xIPOyUtNlX9KNGKM5780CIukwzOVRL0kKUo95hm GCJ6AZIHn0xyoVcyBitIHiAnj+/qHZINQDFM0= On Sat, Oct 4, 2008 at 2:52 AM, Quinn <eskimo1(a)apple.com> wrote: > If you don't care about creating a real product, you have more options. > Specifically, if you link against the entire kernel you should have access > to task_set_special_port, which is a necessary first step. You will also > need to use MIG (in kernel mode!) to generate a demux routine. Make sure > you don't export your catch_xxx routines, lest they collide with the kernel > routines of the same name. Hello guys, I am definitely stuck with this. Basically, I just tried to set the exception port of a specific task with a fresh new created port (inside my kext). Here is my code: kern_return_t ret = KERN_SUCCESS; ret = ipc_port_alloc(get_task_ipcspace(current_task()), &exception_port_name, &exception_port); IOLog("ipc_port_alloc() ret=%d", ret); if (ret) return kIOReturnError; ret = task_set_exception_ports(target, EXC_MASK_ALL, ipc_port_make_send(exception_port), EXCEPTION_DEFAULT, THREAD_STATE_NONE); IOLog("task_set_exception_ports() ret=%d", ret); if (ret) return kIOReturnError; /* create exception handler thread */ (void) kernel_thread(kernel_task, exception_handler); Unfortunately, this code freeze inside the task_set_exception_ports call. I have no idea on what's going on... Thank you in advance for your help, Nicolas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: map of system call to tar ball file?
by Kevin Van Vechten 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Oct 13, 2008, at 2:20 PM, Todd Heberlein wrote: syscalls are implemented in the kernel "xnu". Not presently, sorry. It's something we're looking into though. - Kevin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… OK, I found open() in Libc-498.1.1, but it just calls __open_nocancel (). Any idea where I can find this function? And back to the original question, is there an easy way to find where these functions might be so I don't have to ask? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Including kern clock.h from a non-kext application
by André Berg 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Hi Mike, André --- Original Nachricht --- Absender: Michael Smith Datum: 13.10.2008 20:37 Uhr On Oct 9, 2008, at 3:58 PM, André Berg wrote: DTrace, perhaps? = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks for your nice suggestion. It's a funny coincidence, half an hour before reading your mail, I started reading Sun's Dynamic Tracing Guide :) Again, thanks for helping. I am just trying to find a relatively save and easy way to do high-resolution performance counting on Intel/PPC archs, preferably using system provided functions which already cover a larger armount of hardware/software configurations. This email sent to site_archiver(a)lists.apple.com

1 0

Re: map of system call to tar ball file?
by Todd Heberlein 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com OK, I found open() in Libc-498.1.1, but it just calls __open_nocancel(). Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Any idea where I can find this function? And back to the original question, is there an easy way to find where these functions might be so I don't have to ask? This email sent to site_archiver(a)lists.apple.com

1 0

map of system call to tar ball file?
by Todd Heberlein 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I am looking at the lengthy list of source code tar balls for Darwin at http://www.opensource.apple.com/darwinsource/10.5.5/ Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… and I was hoping there might be a map between system call (or library API) and the tar ball where it might be implemented. Does any such animal exist? In particular right now, I want to look at the implementation of the open() call to look at the creation of audit records in this system call. Anyone know where I should start looking? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Executing an application
by Todd Heberlein 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… (2) Common Criteria Auditing is narrowly defined by use model; as long as you don't use it outside the model, it remains valid. For system components shipped by a vendor, existing behaviour is technically allowed. Outside that, well, choose to use code paths involving execve() rather than posix_spawn(). This doesn't make sense to me. The BSM Auditing is positioned as a security capability and is required for certain certifications (like various Common Criteria levels); it shouldn't be trivial to bypass the security by simply using a different API. Do not expect a "hot fix" for already released code, and do not any fix whatsoever unless you file a bug report through the proper channels, rather than posting on a mailing list. Agree. I like to use the mailing list to get pointers for where to look (e.g., pointing me to launchd for starting applications via the dock) and then getting confirmation on how I think things are working. This makes it easier for me to file a more specific (and hopefully useful) bug report. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Executing an application
by Todd Heberlein 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… My advice to you would be to file a bug report. I filed a bug report the posix_spawn() problem yesterday. Bug ID = 6287352. I also filed a bug report on open() with write flags -- the name of the file being opened is *not* included in the audit record (interestingly, it is for files opened for just reading). Bug ID = 6287427. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Executing an application
by Terry Lambert 13 Oct '08

13 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com My advice to you would be to file a bug report. -- Terry On Oct 13, 2008, at 11:07 AM, mm w <openspecies(a)gmail.com> wrote: Hi Terry, fair enough yep I'm right with this, but it doesn't solve the Finder part, and it's not my point I don't expect a Hot fix, it's somehow always a bad thing, my point was Leo should go thru a couple of revisions before snow-leo release, and it's not a "Big move", saying you have to wait for the next release of the OS was a kind of an "abusive answer", my point is I never argue about the Apple priorities and I 'm aware there are a "couple other stuff" to do, but this is a part of "seatbelt" improvement politic _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Actually, seatbelt uses MACF, the Mandatory Access Controls Framework, not auditing. And yes, there is an execve() variant that permits setting of a MAC label on exec, but not one for posix_spawn(). We don't really hace a statement other than that, since we can't really comment on future product directions as part of our employment contracts, On Mon, Oct 13, 2008 at 10:47 AM, Terry Lambert <tlambert(a)apple.com> wrote: There are a couple of easy answers on this, but you are not going to like them: (1) Fix the problem and build your own kernel. Submit the patches back to Apple to increase the probability that things will be fixed the way you want them fixed. (2) Common Criteria Auditing is narrowly defined by use model; as long as you don't use it outside the model, it remains valid. For system components shipped by a vendor, existing behaviour is technically allowed. Outside that, well, choose to use code paths involving execve() rather than posix_spawn(). Do not expect a "hot fix" for already released code, and do not any fix whatsoever unless you file a bug report through the proper channels, rather than posting on a mailing list. Cheers! This email sent to site_archiver(a)lists.apple.com

1 0