September 2009 - Darwin-kernel

Re:Re: How to know the existance of the instance of IOUserClient
by searockcliff 29 Sep '09

29 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

VFS plug-in for single file io filtering.
by Inso Reiges 28 Sep '09

28 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=N6c+03OdD2TsHIQbSEAGFPK1C3zGr7H7EVI03LNLJ1I=; b=oCnp32RM6iwmgTRgNJtPQQfTQX1WNYcrYto8Sln5MbhsclkQjhozoDhTGM5OqRt82y n8tD7QUTWmqRTMsLmP+KreiPcPzuZWAzAbex5ddzKZYgM+IUJEnpg/N5g8h6zaIhk6Mm CycIOGPeA9eplDWrXzrWkmqG9izJNRLPZW67M= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=mLkeZL6o8fp41m8GkoGV83E1dO+hX6hwXtvMeUeb+K5ygHGA3v7QuSpCSTdn59Qawa vHCvmZ0hkCIOXuORR64EY/JK51MEotf35jphIG0On7KoGRVlrA9eqqVy1d57LUO73ynL DJvwEpaDRJaL69ge/wAKMubQSx5IGTHba03SQ= Hi, I am new here (and to the osx development in general), so please bear with me. Also. if this is not the best mailing list for me, please direct me to the one that fits better. I need to create a solution that will solve the following problem: 1) With the help of user-mode program it will take an arbitrary existing file and a specified block mask. 2) Will present an access to said file as a contiguous space mapped by specified sector mask through a BSD-style block device. As an example, suppose i have a file and i want to create a device /dev/something as an access point for this file that will map read/write from/to block 0 to real block 4 on the original file. I need this to port a part of the existing container encryption software from windows and this setup (block devices) is kind of a requirement, i.e. i am not allowed not take a different approach on how i present the access to contiguous space now. This is how i though i can accomplish this: To set up such a device i need, obviously, a modified loopback-kind driver for this device. I know about existence of hdiutil and an I/OKit DiskImages driver for that part and i decided that a sane way to take is to use this existing functionality. DiskImages driver does not know about any of the mapping stuff i need to do so i figured i need to implement a layer that will transform my original file into another file (with the 'dmg' extention). This layer is also best suited to perform i/o mappings so i can proceed with hdiutil on that new file to create a required loopback device node. Since i can't use macfuse (another requirement) i thought of a lightweight VFS kext that will present mapped .dmg file as a single root vnode and will use read and write vnode ops to pass the request to the actual file with corrected offsets. I can pass the block map and a file descriptor from user space program to mount(2) call, which will mount my VFS plug-in fs and give me a corresponding .dmg file to pass on to hdiutil. The question is, being a kernel newbie, before i start, what pitfalls do i need to be aware of? Is it at all possible? If it is, what is the best way to pass a read/write requiest from a VFS plug-in to the actual file? I also welcome any suggestions of a different solution architecture. Best Regards, Inso Reiges. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to know the existance of the instance of IOUserClient
by Michael Smith 27 Sep '09

27 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

How to know the existance of the instance of IOUserClient
by searockcliff 27 Sep '09

27 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Increasing NGROUPS_MAX
by Terry Lambert 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Honestly, I don't know. Have you tried asking the mail server team? -- Terry Kristan You can't do that, and you should not be trying. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This is because I don't know what configuration options, etc., are used in a default deployment. Dovecot allows a lot of them, including running all the users under a single system UID and doing access enforcement via connection credentials, and its ACL and preferred quota implementations don't fall through to native kernel enforcement, so it's entirely possible that it maintains its own account database separate from the system account database. If so, the problem you ran into would never come up because it would never be messing around with local system credentials at all. FWIW, this is the configuration I would have picked because of connection scaling for clients that like a connection per mailbox and ignore request/response tags, like the old OutLook; it doesn't make sense to have a process per connection or a process per client, if you want to support as many clients as you can. On Sep 23, 2009, at 6:09 AM, Kristan Klett <kristan(a)familie-klett.de> wrote: Terry, thanks for your explanations. Clarifies a lot. So what I have done is to mask out the setgroups() part if restrict_access.c in dovecots code. Hardened the groupID and fixed ACL to Mail-Dirs asf. Just for my curiosity: What changes have been made to dovecot code when it was bundled with SL Server Edition ? There must have been the same issue I encountered Terry Lambert wrote: On Sep 23, 2009, at 2:29 AM, Kristan Klett <kristan@familie- klett.de> wrote: I'm using dovecot as imap mailserver on my Desktop Mac Mini. Since my upgrade to SL I cannot login to imap mailserver because my account is defined to more than 16 groups since having upgraded to SL (not the Server Edition). I can find 19 groups where at least 14 are groups introduced for sharepoint connectivity. dovecot fails with the systemroutine setgroups() Error EINVAL. How can I increase the systemvariable NGROUPS_MAX in order to support 32 groups with the systemcall systemgroups() ? I'd like to increase this without recompiling the Kernel ;-) Directory services supports an arbitrary numbers of group memberships, including groups of groups, and it does so by virtue of the question of enumeration of the groups list for a given user (mostly) never coming up. Instead, all kernel authorization operations around the Tiger timeframe were modified to ask the question "can actor A perform operation B on object C?". At the same time a new field, cr_gmuid was added to the BSD credential, and then the question that gets asked is "is kauth_cred_t a member of group X?" to make group membership based authorization decisions. The first line of inquiry is test_gid vs. cr_groups[0..cr_ngroups], and then if the answer is "no" and cr_gmuid is set, it calls out to user space to ask "is cr_gmuid a member of group X?", which directory services then answers. None of this should keep you out of your IMAP server, since your IMAP server could care less who you really are, so long as your mail client presents a valid account name and SASL password and you get an appropriate euid and egid for file permissions enforcement. However, instead of just being what it's good at and IMAPing away, it looks like your server is calling setgroups() in order to try and be an authentication gatekeeper process and establish real local credentials, instead of the minimum credential that would work. If it's going to do that, it should be a good citizen and use the PAM modules to authenticate against directory services, instead of trying to fake up a credential on its own. If on the other hand it's something like sshd or telnetd, it should be internally running /bin/login to do its session management. For one thing, it will have an incredibly tough time of it unless it calls initgroups instead of setgroups. Even then, it's still going to have a tough time of it because there is a very specific order of operations required to opt a newly created credential into external group membership resolution by directory services, part of which require that both the client and server are bound into the same security association. This is necessary so that the vended group list is identical in both places so directory services gives the same answer to the "is cr_gmuid a member of group X?" question. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

triggered DYLD shared region unnest
by Jon Nall 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:content-type :content-transfer-encoding:subject:date:message-id:to:mime-version :x-mailer; bh=N0d8XjvD7J8KmbGKXQZtIZ02kzeL/R1qQv0BL+4jrnU=; b=GhPGRJSakvocVHGqPPsgV3OKTbFZUoNni51kD9kNZzX9AJlyPNnZihM7/daPEdRSOf UeKJisxf73vi0IMKLzNM0nkvVr6pf26CFadpS8Wx++hpjTcgDM4OFwoWPQZjqSFZfPwf LWYDTAdfSc4ZULrGSEplipTl7eLVOEw912g8c= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:content-type:content-transfer-encoding:subject:date:message-id :to:mime-version:x-mailer; b=a4EF8m3pqxmE2nLSIKmMmpYZZx5/OlcetZRoJ3bvp6MbuJTmKsZu9oR96t4o67OFo8 6s1IYpPLBSAVPbeLgWl+2+oL0y7VVhsB3S3hGixMmuqDogun27LD65VTdhS02bG3U5xc yw9aLKaCtEUl8wyBAvJxuBV+4yNveXIYUkspc= Hello. I'm getting tons of messages like the one below in my dmesg output. I've traced it to the log_unnest_badness() call in vm_unix.c, but I'm not quite sure how to proceed to debug. If someone could help me debug this, I'd be most grateful as my memory seems to just get sucked away fairly quickly. System Events (map: 0x7697ae4) triggered DYLD shared region unnest for map: 0x7697ae4, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Increasing NGROUPS_MAX
by Kristan Klett 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.23 (Windows/20090812) Kristan You can't do that, and you should not be trying. -- **************************************************************** Kristan Klett mobile: +49-172/8326305 Hedwig-Kettler Strasse 18A Tel : +49-40/251523-141 23843 Bad Oldesloe mailto:kristan@familie-klett.de Germany http://www.sundragons.de **************************************************************** _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Terry, thanks for your explanations. Clarifies a lot. So what I have done is to mask out the setgroups() part if restrict_access.c in dovecots code. Hardened the groupID and fixed ACL to Mail-Dirs asf. Just for my curiosity: What changes have been made to dovecot code when it was bundled with SL Server Edition ? There must have been the same issue I encountered Terry Lambert wrote: On Sep 23, 2009, at 2:29 AM, Kristan Klett <kristan(a)familie-klett.de> wrote: I'm using dovecot as imap mailserver on my Desktop Mac Mini. Since my upgrade to SL I cannot login to imap mailserver because my account is defined to more than 16 groups since having upgraded to SL (not the Server Edition). I can find 19 groups where at least 14 are groups introduced for sharepoint connectivity. dovecot fails with the systemroutine setgroups() Error EINVAL. How can I increase the systemvariable NGROUPS_MAX in order to support 32 groups with the systemcall systemgroups() ? I'd like to increase this without recompiling the Kernel ;-) Directory services supports an arbitrary numbers of group memberships, including groups of groups, and it does so by virtue of the question of enumeration of the groups list for a given user (mostly) never coming up. Instead, all kernel authorization operations around the Tiger timeframe were modified to ask the question "can actor A perform operation B on object C?". At the same time a new field, cr_gmuid was added to the BSD credential, and then the question that gets asked is "is kauth_cred_t a member of group X?" to make group membership based authorization decisions. The first line of inquiry is test_gid vs. cr_groups[0..cr_ngroups], and then if the answer is "no" and cr_gmuid is set, it calls out to user space to ask "is cr_gmuid a member of group X?", which directory services then answers. None of this should keep you out of your IMAP server, since your IMAP server could care less who you really are, so long as your mail client presents a valid account name and SASL password and you get an appropriate euid and egid for file permissions enforcement. However, instead of just being what it's good at and IMAPing away, it looks like your server is calling setgroups() in order to try and be an authentication gatekeeper process and establish real local credentials, instead of the minimum credential that would work. If it's going to do that, it should be a good citizen and use the PAM modules to authenticate against directory services, instead of trying to fake up a credential on its own. If on the other hand it's something like sshd or telnetd, it should be internally running /bin/login to do its session management. For one thing, it will have an incredibly tough time of it unless it calls initgroups instead of setgroups. Even then, it's still going to have a tough time of it because there is a very specific order of operations required to opt a newly created credential into external group membership resolution by directory services, part of which require that both the client and server are bound into the same security association. This is necessary so that the vended group list is identical in both places so directory services gives the same answer to the "is cr_gmuid a member of group X?" question. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

Re: VNOP_PAGEIN doubt
by Terry Lambert 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Increasing NGROUPS_MAX
by Terry Lambert 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You can't do that, and you should not be trying. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Sep 23, 2009, at 2:29 AM, Kristan Klett <kristan(a)familie-klett.de> wrote: I'm using dovecot as imap mailserver on my Desktop Mac Mini. Since my upgrade to SL I cannot login to imap mailserver because my account is defined to more than 16 groups since having upgraded to SL (not the Server Edition). I can find 19 groups where at least 14 are groups introduced for sharepoint connectivity. dovecot fails with the systemroutine setgroups() Error EINVAL. How can I increase the systemvariable NGROUPS_MAX in order to support 32 groups with the systemcall systemgroups() ? I'd like to increase this without recompiling the Kernel ;-) Directory services supports an arbitrary numbers of group memberships, including groups of groups, and it does so by virtue of the question of enumeration of the groups list for a given user (mostly) never coming up. Instead, all kernel authorization operations around the Tiger timeframe were modified to ask the question "can actor A perform operation B on object C?". At the same time a new field, cr_gmuid was added to the BSD credential, and then the question that gets asked is "is kauth_cred_t a member of group X?" to make group membership based authorization decisions. The first line of inquiry is test_gid vs. cr_groups[0..cr_ngroups], and then if the answer is "no" and cr_gmuid is set, it calls out to user space to ask "is cr_gmuid a member of group X?", which directory services then answers. None of this should keep you out of your IMAP server, since your IMAP server could care less who you really are, so long as your mail client presents a valid account name and SASL password and you get an appropriate euid and egid for file permissions enforcement. However, instead of just being what it's good at and IMAPing away, it looks like your server is calling setgroups() in order to try and be an authentication gatekeeper process and establish real local credentials, instead of the minimum credential that would work. If it's going to do that, it should be a good citizen and use the PAM modules to authenticate against directory services, instead of trying to fake up a credential on its own. If on the other hand it's something like sshd or telnetd, it should be internally running /bin/ login to do its session management. For one thing, it will have an incredibly tough time of it unless it calls initgroups instead of setgroups. Even then, it's still going to have a tough time of it because there is a very specific order of operations required to opt a newly created credential into external group membership resolution by directory services, part of which require that both the client and server are bound into the same security association. This is necessary so that the vended group list is identical in both places so directory services gives the same answer to the "is cr_gmuid a member of group X?" question. This email sent to site_archiver(a)lists.apple.com

1 0

Re: VNOP_PAGEIN doubt
by Anton Altaparmakov 23 Sep '09

23 Sep '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Best regards, Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer, http://www.linux-ntfs.org/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 23 Sep 2009, at 09:20, anubhav rakshit wrote: I goofed up. I needed to know the protection. I think the closest you can come to that is to implement your VNOP_MMAP () so that when an mmap call happens you can see the protection of the mmap area in the a->a_fflags passed into your vnop mmap function which are a combination of PROT_READ, PROT_WRITE, and PROT_EXEC. This email sent to site_archiver(a)lists.apple.com

1 0