September 2012 - Darwin-kernel

Re: Passing pointers as UIDs | kernel<->userspace communication
by comex 18 Sep '12

18 Sep '12

On Tue, Sep 18, 2012 at 5:22 PM, Jean Suisse <jean.lists(a)gmail.com> wrote: > - The validity of the structure is checked using the "magic" variable (a > member of the structure set to a predefined value, as shown in TCP Log NKE > example). That's not sufficient: for an attacker to even know the value of the heap pointer compromises KASLR, and it's not hard to arrange for kernel memory to contain user-specified values in various arrangements, so he may be able to get the value of text pointers, the HMAC key used to keep App Sandbox secure, or even private data from another app. > However, it would require a fair bit of reverse engineering, since > connection to the kext, thought open to any userspace app, requires the > demanding app to authenticate itself first. > The challenge response mechanism I use is not more difficult to crack than > any other serial-key based authentication. But my app isn't that attractive, > and isn't installed on that many computers to be worth the effort. > I will make investigating this point a high priority. There are a variety of possible threat models here, with varying levels of attacker interest/experience (imagine if your app was known to be installed on some political target's computer); but more importantly, it's not like this is a fundamental tradeoff between security and performance. It's not hard to implement a hash table or just an array, as I said, and have the cost of looking the structure up be almost negligible compared to, say, the system call overhead, so you should do so and avoid the entire security can of worms. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing pointers as UIDs | kernel<->userspace communication
by Jean Suisse 18 Sep '12

18 Sep '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing pointers as UIDs | kernel<->userspace communication
by comexk＠gmail.com 18 Sep '12

18 Sep '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Passing pointers as UIDs | kernel<->userspace communication
by Jean Suisse 18 Sep '12

18 Sep '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Best way to implement multiple UserClient connections?
by James Wise 17 Sep '12

17 Sep '12

Hey All, Please excuse me if i have made any horrible mistakes. So currently I maintain the software stack for a PCI-e add-In card. Eg. Kext, + UserClients, Frameworks, + public API. However I am a bit confused on the best method to implement this process. There is very little different between the input and output UserClients. ( I think this is currently my preferred method) thus forcing all framework instances to talk to a single UserClient. based upon the matching against the entries in the plist. ( i know it's possible, I'm just unsure if this is a good idea or not.) Also I'm not sure if this contradicts this statement (bottom of page) Thanks for any help/pointers/links or conversation, James _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com I am a bit of a newby to this level of OSX programming and would love some hints/tips regarding what i am doing. Currently I have multiple UserClients connecting to the kext, all based IOUserClient, but the most used connections are an InputUserClient, and an OutputUserClient. In turn these two user clients, attach/listen to the input interrupts or the output interrupts that are generated on the card itself. Now the card in question contains not 1, but 2 pairs of interrupts, that is, a total of 4 ( 2 in, 2 out) I am currently trying to add support so that the user space framework may access/connect to a UserClient that makes use of the second interrupts, and enable multiple independent framework instances control of different parts of the card. Basically the only difference is when we request a user Client the name requested is different input vs ouput, ie. the kext lists different names in it's plist, which then determines which UserClient we connect to. and this then dictates which interrupts on the card we listen to for that UserClient. (they actually instance exactly the same IOUserClient derived class, just with slight different options.) As much as anything i am really after information regarding best practice, not just what will work, but the BEST way to make things work 1. Should I create a different instance of my UserClient that is the same in all manner except which interrupts is listens to? thus allowing multiple instances of my UserClient concurrently connected to the kext. 2. Should I just expand the existing UserClient class to support Both/multiple interrupt channels? 3. Is it possible to pass an argument during the UserClient selection/init process? (ie. this would allow me to Specify a video output userClient, with Interrupt 1, instead of the default interrupt value?) OR do I need to create an additional entry in my kext's list of devices in it's plist - so that i can specify which interrupts i want to attach to 4. Is there inherently wrong about having multiple IOUserClients (of the same type, but attached to different interrupts) connected to a kext driver? Currently I think that the best option is #1. ie. to have Multiple IOUserClients that connect to my kext, where Each UserClient listens to 1 of the interrupts, However i'm unsure if this can be done using a single "name" to connect to the UserClient, or if i will need to specify a different service "name" during matching in order to indicate which UserClient should attach to which interrupt "It is usually a good idea to limit access to your device to one user space process at a time." From…. http://developer.apple.com/library/mac/#samplecode/SimpleUserClient/Listing… Anyway I know my Questions probably seem a bit all over the place, but i am struggling to find good examples of more complex kext/UserClient setups and examples, the docs and examples on Apple's website are helpful and useful, but are also simple and provide more technical guidance than a higher level architectural guidance for more complex situations. I also have Amit Sings OSX fundamentals book, which is good, but sort of out of date now, and again doesn't really cover more complex examples such as this.

1 0

Hardware time
by Gerriet M. Denkmann 13 Sep '12

13 Sep '12

There seem to be two clock in OS X: the normal clock (like gettimeofday or NSDate) and a hardware clock, which runs when the computer is asleep or even switched off. Is there a way to query this hardware clock? I looked ad IORegistryExplorer.app but could not find anything. Note: this is to be from a normal Cocoa app, not from a kext. Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: AbsoluteToNanoseconds deprecated - so use what instead?
by Tim Seufert 11 Sep '12

11 Sep '12

On Sep 11, 2012, at 3:03 AM, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > On 11 Sep 2012, at 16:41, Quinn The Eskimo! <eskimo1(a)apple.com> wrote: > >> On 11 Sep 2012, at 10:38, Phil Jordan <lists(a)philjordan.eu> wrote: >> >>> Hmm, this is a kext target, right? >> >> If not (that is, you're doing this from user space) you should use mach_timebase_info, as shown in QA1398 "Mach Absolute Time Units". >> >> <http://developer.apple.com/library/mac/#qa/qa1398/_index.html> > > No, this is not a kext. And using mach_timebase_info() works fine. > > But I thought there would be a simpler, not-deprecated way, without worrying about integer overflows. > Maybe there is none. The first method shown in QA1398 doesn't require you to personally worry about integer overflow unless the time interval you plan to measure is over 584.9 years. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: AbsoluteToNanoseconds deprecated - so use what instead?
by Gerriet M. Denkmann 11 Sep '12

11 Sep '12

On 11 Sep 2012, at 16:41, Quinn The Eskimo! <eskimo1(a)apple.com> wrote: > > On 11 Sep 2012, at 10:38, Phil Jordan <lists(a)philjordan.eu> wrote: > >> Hmm, this is a kext target, right? > > If not (that is, you're doing this from user space) you should use mach_timebase_info, as shown in QA1398 "Mach Absolute Time Units". > > <http://developer.apple.com/library/mac/#qa/qa1398/_index.html> No, this is not a kext. And using mach_timebase_info() works fine. But I thought there would be a simpler, not-deprecated way, without worrying about integer overflows. Maybe there is none. What I really want: something to measure relative times less than a microsecond. Both NSDate and gettimeofday have only microsecond accuracy. And mach_absolute_time uses "ticks" whose value depends on the cpu. Is there some other (simple, non-deprecated) time function to use? Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: AbsoluteToNanoseconds deprecated - so use what instead?
by Jean Suisse 11 Sep '12

11 Sep '12

There's a similar discussion on the Xcode users list from Gerriet M. Denkmann. I post it here in the hope it contains relevant additional informations. >> On 11 sept. 2012, at 11:15, Gerriet M. Denkmann wrote: >> >>> I added the Kernel framework to my project, and now the linker says: >>> >>> ld: framework not found Kernel >>> clang: error: linker command failed with exit code 1 (use -v to see invocation) >>> >>> The linker command is kind of long, but it ends with: >>> -mmacosx-version-min=10.7 -fobjc-arc -fobjc-link-runtime -framework Kernel -framework IOKit -framework Cocoa -o <...some very long name...> >>> >>> So: where is my Kernel framework? >>> What am I doing wrong? >>> >>> 10.8.1; Xcode 4.4.1 >>> >>> Gerriet. >>> >>> P.S. and how to access the headers? >>> >>> #import <Kernel/Kernel.h> does not work: file not found. >>> #import <Kernel/kern/clock.h> gets found, but it contains a reference to <kern/kern_types.h> which is again NOT found. > On 11 sept. 2012, at 11:41, Quinn The Eskimo! wrote: > > On 11 Sep 2012, at 10:38, Phil Jordan <lists(a)philjordan.eu> wrote: > >> Hmm, this is a kext target, right? > > If not (that is, you're doing this from user space) you should use mach_timebase_info, as shown in QA1398 "Mach Absolute Time Units". > > <http://developer.apple.com/library/mac/#qa/qa1398/_index.html> > > Share and Enjoy > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: AbsoluteToNanoseconds deprecated - so use what instead?
by Quinn "The Eskimo!" 11 Sep '12

11 Sep '12

On 11 Sep 2012, at 10:38, Phil Jordan <lists(a)philjordan.eu> wrote: > Hmm, this is a kext target, right? If not (that is, you're doing this from user space) you should use mach_timebase_info, as shown in QA1398 "Mach Absolute Time Units". <http://developer.apple.com/library/mac/#qa/qa1398/_index.html> Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0