May 2011 - Darwin-kernel - lists.apple.com

Re: The correct way to identify applications in a kext
by Juuso Salonen 12 May '11

12 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=jDqzuW9CSdzKVNeWThnvHV2NFC6IacNpjDZj3wUJbqA=; b=GvTMm5EeMq2AAys2ISiiXhp973slaE/GEtgdH67swwDa+ScMEVBQwXXS5NeM9JMaPs NAkHBYor15zytRoCDOF3MwMY3wz9LSXLN5VdUnLmh0PssTWLhtBCk8kEampibCZ2buLL 2ecWnARAAdHviX4OjBP355HnQHmlx/e2EiFio= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=GX1+rTo3Sqv/KQ1clP2++kZBKKLsG9h+9Xe9ZGScvYO1kDTnC2+oLrW+MgMD6BIiF8 NkkW5VeddIUv6vApVMHm4AdiPGisUCy9rBP69EeTuq+EmaRh9xTkcfbY8vckzPFF5rDe UENviUubsaJrnDWPVxl/LyMj5hKlz/tyeKM58= On Thu, May 12, 2011 at 1:23 PM, Quinn "The Eskimo!" <eskimo1(a)apple.com> wrote: > You can't call the code signing API directly from your KEXT. The traditional approach is to have a user space helper process that performs code signature verification on your behalf. Your KEXT can then cache the code signing result for the lifetime of the process This user-space-helper approach is something I feel queasy about, although it is probably caused by my lack of understanding. Simply put, isn't it way too slow? I'm under the impression that when one of the socket filter's callbacks gets called, it should return with an answer as quickly as possible. Sending a kernel control socket message to the userland daemon and waiting for an answer sounds like unacceptably sloppy behavior from a kernel-level socket filter. Is my speed concern valid? Perhaps I am thinking about the kext-daemon communication in a wrong way. Also, thanks for your answer about the code signing API. It does indeed look like the right way to do app identification. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: The correct way to identify applications in a kext
by Quinn "The Eskimo!" 12 May '11

12 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 12 May 2011, at 10:20, Juuso Salonen wrote: > If code signing is not the answer, are there other options? Code signing is the only reliable way to check for code identity; every other solution can either be spoofed easily (for example, the binary name or path) or suffers from false positives (for example, a checksum of the binary). You can't call the code signing API directly from your KEXT. The traditional approach is to have a user space helper process that performs code signature verification on your behalf. Your KEXT can then cache the code signing result for the lifetime of the process [1]. > I was unable to find any relevant information about using code signing for kext development. There are four components to this solution: o KEXT -- I presume you already have this under control. o user space helper -- You would typically make this a launchd daemon; if you need help with that, let use know. o code signature checking -- Within your user space helper you can check code signatures using the SecCode API. <Security/SecCode.h> is a good place to start here. o KEXT/user communication -- I typically recommend a kernel control socket <sys/kern_control.h> for this. The tcplognke is a good place to start with kernel control socket. <http://developer.apple.com/library/mac/samplecode/tcplognke/> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware [1] While the validity of a process's signature can change during the lifetime of the process, it's probably not worth worrying about that complexity in your situation. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

The correct way to identify applications in a kext
by Juuso Salonen 12 May '11

12 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to :content-type; bh=XBzuMjKOL6F5bTWXDcIc3QrfQh1hShqG0IHvdBPM8mE=; b=b8mD9aeR4pLfj6Pyit/iipYsTSai3ApiHWTyLITomynfWZ1lK6OXx9OcVtX0QIsf93 VyhbX0cQgh82xF1HK0CHyXV1BUjKdk0v6Ex/0B1Tuk7YVNuv6A3Ubp++Xs/WrauTG8tv 9PWZ2QQ9W4BURAw+FJQy9g+ZJEAKcei9tJiXU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=eCEXyEVL669rb58YqmKqfhiWzGeJxMQdKqmwzxo561gTHJHbjZPJFkmLRleCdVViRO CWj5JfKRzMQVQvsKh0d3/HpITPSgtnPfJr2BpA8D26nK8tlkz8gXzb52J0JVielCG+aV V6rJG4+9avvtP1jrnLgo31xmuYNSQMovPUDSg= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Is it possible to close a kernel control socket in kernel extension?
by Nick 07 May '11

07 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=PcfhJcvc/XZRWpoyyX04uGmMW7jh7Az9zR04R6nLiuo=; b=KLEgN9ne8g6C0euFZkda3aHh8mREzSNxt35TtDm4wxjvWLtaQEAOQ5Fg1jmMErvH1r G/lYYbqAjGQKrTqVvGHZnjUuunIVzXYCOtrDQGSp7a+/4W6RRJN64N0UrTSi/goZzAx6 hJrzZOjYyRShP3zUUDw+hbFKJ4JY3OCC8dcuA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=bxhKJwTT5zK4A4pLKk6fLN+xIeGAQMpIBAiNCGpIDGtD8H5zmG6dUg3znvlnUofm5h 0xoVxU3aPpaqso1/anC7+IklicuBCS2hGgJkMPpdKL+KizcFJ56x+LotHWybcNDInmLo mZZln6CbFio5Fi8SXehYEhhNM50XYhduCYqqY= When a usermode process gets killed, the system closes all opened descriptors for it, including your control socket. The only "annoying" thing may occur when you unload your kernel extension before your application actually closed: your application has dangling file descriptors pointing on non-existing in kernel socket. The solution is simple - don't let this happen, by checking if all usermode control sockets have been disconnected. See tcplognke sample how to not let it be unloaded when its inappropriate (in kext's unload routine you should return something different from KERN_SUCCESS if your socket's ctl_disconnect_func haven't been called, for example). 2011/5/7 Mike Chen <ccp0101(a)gmail.com>: > Hi, > > I looked at the docs and I found no method to close an already > established control socket in kernel. I can do it in userspace with > close(file_descriptor) but it becomes very annoying when userspace > application gets killed or encounters unexpected error that causes it > to shutdown before doing close(). Anyone has a suggestion? > > Thanks. > Mike. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/eveningnick%40gmail.com > > This email sent to eveningnick(a)gmail.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Is it possible to close a kernel control socket in kernel extension?
by Mike Chen 07 May '11

07 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:from:date:message-id:subject:to :content-type; bh=nozOy4gM3nv3g4jE2hU4/j1FOGr058/4t3crMCwqy2A=; b=LY3v1+rIkcu/097PdpZCSK8Ws3y684TGiuY98/rtYdndcR09D5UkzHZ3FHvj64Pr5k xJPrU1MeJRbqiAwFx4bfxg1lYy1jZaviEiTZvZsBvvbXf+rU3ED2h3bqporL2VAEW+ep GmoBiVrB+ag18RkXvUGMU7ENdsxe0daz8M8wQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=gyyxj3XWJJuh08MHsMlz8rhOKxTyEqhqYOg+QLMBzcovO/jdu5Ci3exSjK23ISbZcj JoMm6W7kOGAogSR3JtuU5PqTiE7Gw7RGXT8PkmsqPUDr/WnYKF2MwzmYPemamYaiMbq5 5QbTbYj8abBT+c84tedBOv6ndIn5fBpxkRHwU= Hi, I looked at the docs and I found no method to close an already established control socket in kernel. I can do it in userspace with close(file_descriptor) but it becomes very annoying when userspace application gets killed or encounters unexpected error that causes it to shutdown before doing close(). Anyone has a suggestion? Thanks. Mike. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Working of KAUTH_FILEOP_CLOSE_MODIFIED flag in KAUTH_FILEOP_CLOSE
by sheetal phirke 06 May '11

06 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.in; s=s1024; t=1304661371; bh=0I/Q35RjKBFWTYoUB4iB3+IBU2lapJWfag4rVVVK8tc=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Nej7713rXI+qNw77JrMzyJj8Avv5VZQMXjTYWqiHDfgPjhglM3QdUEpKfJRiSNlFZvSvmkbFJ2opQvMOefhA+Ehllh1LWCMYGVJr+wxzf1DlYDbmb8nzYHgaCFiOPvddqTzTCi2mvcyefM91i7ujuYmbO/JrBv3j+sayVhBwxHM= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.in; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Wwhnj91uu2YpM4ytZnc+1QlmaR+g8M3kFH/HO8rJPoNN98+1tuttteKPsW3c9SuMJFFO/JEY6mNp1bAZI4nBCw38tWTCxfU6742izHzZ+y/OIgOYFgFj5Ce+NQAl9YL2bbcfUYeUuduVRlbmcRUDnALUyuDctVIetrSliACAhNI=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Working of KAUTH_FILEOP_CLOSE_MODIFIED flag in KAUTH_FILEOP_CLOSE
by Alexander Dimitrov 05 May '11

05 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type; bh=Jj36eY3QDYTQPkWdvHQpNUSO+TExqPsp04vCh/fge9s=; b=VkRtnEzKSoh+fkV8/RBC8SJsAxP82FYIxClyFq6JyhMi7FT5tZgbVqeAhtxGTQJ1Jl /DGdd+IZt4Z/IKYXLaJlgwdBW6D4hS+vqYs0LrK4o0tDiuqfJHZDUBFrV4WZ4sx0FWPX tKTjfd+ARrjeHM740SvPanOLFFc095YLYRsIk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=TdJcmdNTDLFXDs0hSMYiNfbMNCryAK3lJfRmUV9qmqHR7ByYHK+nHY1B1PIU+4vRDO I0jpl14tHl3ynGkxYfVEyb/ZzLIqGd2vmvcAsIqynYr0weUPpGUIBRBd9ZPRduehXG+Y +ffe3s32VdByPZSoM8kqOtA5JcRv294tMM/aA= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Working of KAUTH_FILEOP_CLOSE_MODIFIED flag in KAUTH_FILEOP_CLOSE
by Ken Hornstein 05 May '11

05 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com >waiting for ur reply..... Dude, I hate to be the one who has to explain this to you ... but sending these messages repeatedly is simply NOT HELPING. This is an unofficial mailing list; people can either choose or not choose to reply to your questions. I replied to your earlier message because I was curious and I had a few free minutes to trawl through the MacOS X source code to look up the answers. But in regards to your later questions ... well, I don't have the time to look it up. It's nothing personal, and it's not like you're the only one in this boat - I had a question on here a few weeks ago that no one replied to. But I didn't repost it; I just grumbled to myself for a few minutes and then moved on. In your case the answers should be available in the MacOS X source code, which you can freely download from Apple (that's all I used to answer your questions last time). Combine that with some system call tracing and you should be able to figure this out. So, in short: suck it up and do it yourself. --Ken _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Working of KAUTH_FILEOP_CLOSE_MODIFIED flag in KAUTH_FILEOP_CLOSE
by sheetal phirke 05 May '11

05 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.in; s=s1024; t=1304602148; bh=NaXYPwUpi3Ziq7ouw7IjPAbNbBXJr3sg/q/NMYi71QU=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=SuwEODyGh9Dn6z7bi/bTfTHMKJR/nUobdusyq8xUwNYmEwdndgupM1iy3GtzgbVhzMuochuLnoMi2LIpxPTOhA0zP3f9neN2lYJ3B3aA2Ib97kR9wC/iqOpEmvUXP4so7uAAucPAG8w4e4IlzmumOkWfcTFCbYq61xGXDpIo8Qk= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.in; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=ofcU9WCDfrTjb0G0D0Jj6SphxPNv/T4J2Xp7sflPd+F3FggVLT9BrXHH7q5fCKuYWT0RNoFiMkmjTPukkVuoAovh1+a/2cb+hDUnXD6pth09tNKvuoKpjHXb7HZQwMwIIWOPXOFKFtcD09JFi2EGMlJ3QOYh29YjCCzfr/winNg=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determine a process that "owns" the socket_t
by Ken Hornstein 04 May '11

04 May '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com >I am writing an NKE filter, and I'm wondering if i could get a process >name (ideally - a full path to the process) that my filter has been >attached to. When my "attach" function has been called, i have a >pointer to the socket_t structure. Is there any way to trace the way >to the process (a process' PID identifier) that has opened this >socket, and find out its name? You know, this question has been asked (and answered) in the mailing list archives :-) But, in short: - You can't necessarily turn a socket_t into a process (because multiple processes could have that descriptor). - But you can find out the context that invoked you at NKE attach time, which at least in some cases will be the userspace process. See the Apple sample code for tcplognke, specifically the use of proc_selfpid(). Note that in some cases (see the mailing list archives) this won't be useful to you. - You can use proc_selfname() to get at p_comm, which is probably the closest thing to what you want. But you should read this first: http://lists.apple.com/archives/darwin-kernel/2008/Mar/msg00086.html Although ... I'm sure Michael Smith has forgotten more about the Darwin kernel than I will ever know, but I don't see how you can change p_comm from userspace. But all of the usual caveats apply here - using this is almost certainly the Wrong Thing to do. --Ken _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0