January 2013 - Darwin-kernel

Re: To change Trash path...
by Quinn "The Eskimo!" 31 Jan '13

31 Jan '13

On 31 Jan 2013, at 07:06, simran charley <simrancharley(a)gmail.com> wrote: > Is it possible to change trash path (~/.Trash) of user? No via any supported mechanism. Also note that the path you quoted is only relevant for the volume containing the user's home directory. On other volumes the trash is managed different (either there's no trash or it ends up in /path/to/volume/.Trashes/<userID>/). Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

To change Trash path...
by simran charley 31 Jan '13

31 Jan '13

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

sock_send takes longer on MAC 10.8
by Pratima Kudale 09 Jan '13

09 Jan '13

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

MAC policy lifecycle and label invalidation
by Phil Jordan 09 Jan '13

09 Jan '13

Hi, I'm currently implementing a Mandatory Access Control (MAC) policy for a customer and trying to come up with a good architecture for labeling vnodes and mount points. During policy registration with mac_policy_register(), I receive a label slot index which lets me deposit a void* or long within the label struct associated with each kernel object (mount_t and vnode_t in this case). This sounds fine in theory, but in practice, the kernel APIs don't seem to allow me to clean up the label slots when deregistering a MAC policy. When I call mac_policy_unregister(), "my" slot is recycled, and when another MAC policy registers (which can be another kext, or a new instance of mine), it will get my old label slot values for vnodes and mount points which have survived. So unless I can clean up before deregistration, I can't trust any pointer values in label slots, as they might point anywhere. My approach to cleaning up would be to call vnode_iterate() and vfs_iterate() and zero out my label slots prior to deregistering the policy (and set a flag to prevent any MAC callbacks from re-setting it in the meantime). But there doesn't seem to be any (public) API for gaining access to the label directly given a vnode or mountpoint pointer. (vfs_mntlabel() is private, and the vnode struct is opaque; Apple code just uses its v_label field directly) One alternative is to store unique IDs in the label slot and look them up in a hash table or similar; if an unknown ID is encountered, we know it's a leftover from a previously registered MAC policy. There's still a risk that the IDs aren't as unique as hoped, especially on 32-bit kernels. So it might actually be better to use the vnode_t or mount_t pointer value directly as the key into the hash table, which raises the question: If that's what we need to do, what's the point of the labels then? The second option is to just not allow kext unloading and never deregister the policy. This seems bad, too. So: how are we *supposed* to use the labels in MAC policies? Are there some public APIs that I've missed? Many thanks, phil -- http://philjordan.eu/ - Phil Jordan, software development contractor _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kuncexecute()
by Mehdi Esmaeelpour 09 Jan '13

09 Jan '13

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kuncexecute()
by Quinn "The Eskimo!" 09 Jan '13

09 Jan '13

On 9 Jan 2013, at 14:02, Mehdi Esmaeelpour <mehdi.esmaeelpour(a)gmail.com> wrote: > My user-space program get the current focused window(application's name) and i want to use application's name(string) in kernel-space program Indeed. This present some serious architectural issues. For example: o it's possible for no user to be logged in o it's possible for multiple GUI users to be logged in (via any combination of the console and screen sharing) o it's possible for GUI users to be logged in but with none of them on the console What are you expecting KUNCExecute to do in these cases? This gets back to something I mentioned earlier: KUNCExecute was deprecated because it's fundamentally incompatible with the OS X architecture. In your case you should have a GUI launchd agent, with one instance per GUI login session, that communicates the state of that session to your kernel extension via standard user-to-kernel IPC. These GUI launchd agents will always be running in the correct GUI login context, avoiding a whole world of grief. You might also want to look at Technote 2083 "Daemons and Agents", which discusses the background to this issue in laborious detail. <https://developer.apple.com/library/mac/#technotes/tn2083/_index.html> Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kuncexecute()
by Quinn "The Eskimo!" 09 Jan '13

09 Jan '13

On 9 Jan 2013, at 13:09, Mehdi Esmaeelpour <mehdi.esmaeelpour(a)gmail.com> wrote: > In fact,I want to execute a program in user-space(or user-space functions) from kernel-space and get output in kernel-space then use that output. And what does that program do? The best approach to use depends a lot on the specifics of the task. For example, if you want to display user interface to the user that's going to need a very different solution than if you want to do some file system work. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kuncexecute()
by Mehdi Esmaeelpour 09 Jan '13

09 Jan '13

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: kuncexecute()
by Quinn "The Eskimo!" 09 Jan '13

09 Jan '13

On 9 Jan 2013, at 12:31, Mehdi Esmaeelpour <mehdi.esmaeelpour(a)gmail.com> wrote: > Is there any alternative to KUNCExecute() ? KUNCExecute was deprecated for good reason--it's fundamentally incompatible with an important precept of OS X's overall architecture--and thus there's no direct replacement. If you explain your high-level goal we should be able to suggest a better approach. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

kuncexecute()
by Mehdi Esmaeelpour 09 Jan '13

09 Jan '13

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0