July 2015 - Darwin-kernel - lists.apple.com

Version of pf in Mac OS X 10.10.4
by Q and A 25 Jul '15

25 Jul '15

Hello, I am currently working on pf rulesets for a number of Macs. The syntax of pf.conf is a bit different than that in the most current release of OpenBSD which got me wondering what version of pf is integrated into Mac OS X 10.10.4 (what my workstations are currently running). According to Peter Hansteens’ book “The Book of pf, 3rd ed”, on page 193: "In PF versions up to and including OpenBSD 4.5, the scrub keyword enables network traffic normalization. With scrub, fragmented packets are reassembled, and invalid fragments—such as overlapping fragments—are discarded, so the resulting packet is complete and unambiguous.” In man pf.conf on Mac OS X 10.10.4, there is mention of this: "Packet normalization is invoked with the scrub directive.” Hansteen also notes that post-OpenBSD 4.5, a match rule is used with scrubbing instead: "In OpenBSD 4.6, scrub was demoted from stand-alone rule material to become an action you could attach to pass or match rules (the introduction of match rules being one of the main new PF features in OpenBSD 4.6). …which would imply that if pf in Mac OS X 10.10.4 was in synch with post-OpenBSD 4.5, scrubbing would be accomplished via something like: match in all scrub …etc. On : http://opensource.apple.com/source/xnu/xnu-2782.1.97/bsd/net/pf.c …I can see the following in the comments: $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */ …while on: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf.c?rev=1.935&content… …I can see the following in the comments: $OpenBSD: pf.c,v 1.935 2015/07/21 02:32:04 sashan Exp $ */ …so it safe to say that they are not both running the OpenBSD 5.7 version of pf. What OpenBSD version was pf pulled from for Mac OS X 10.10.4 and looking forward, what version is expected to be in the final El Captain release ? Thank you for your assistance _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing per-process information between KAUTH calls
by Stan Sieler 23 Jul '15

23 Jul '15

Re: > On Jul 23, 2015, at 7:16 AM, Slava Imameyev <slava.imameev(a)gmail.com> wrote: > > as there is no notification on process termination Annoying. I put that into MPE/iX back around 1982. Your process could say “when process X terminates, let me know” or “when any process terminates, let me know” (“let me know” meant “here’s the function you should call for me on my stack”). At termination, the process-termination-notification list for the process would be traversed, and all interested processes would be sent a form of interrupt saying “process Y terminated due to reason X, cumulative CPU time it used was K” (i.e., the recipient would get some potentially useful information). (Of course, if the interested party had terminated, no interrupt is sent to them.) Naturally, we sent the PID and the extended-PID (a 64-bit unique value that completely solved the problem other people *still* have forty years later with not realizing a PID has been reused :) I just wish old ideas didn’t keep getting lost. Stan p.s.: yeah, this is a Mac darwin kernel list … so why mention ancient history? In the hope *someone* will see it and get the idea into OS X! _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Why the debugger machine ( source ) has to be Yosemeti for target being Yosemeti
by Quinn "The Eskimo!" 23 Jul '15

23 Jul '15

On 23 Jul 2015, at 16:31, Prokash Sinha <prokash(a)garlic.com> wrote: > Anyone from Apple can enlighten on this ??? I'm trying to get a handle on what the issue is here. All this discussion of "mounting" made me think that the .dmg wasn't actually mounting. But I just checked that and the 10.10 KDK disk image mounts just fine on OS X 10.9.5. Is the problem that the .dSYM files are embedding in an installer? And thus you can't access them directly once you've mounted the .dmg? Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Darwin-kernel Digest, Vol 12, Issue 30
by Prokash Sinha 23 Jul '15

23 Jul '15

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing per-process information between KAUTH calls
by Slava Imameyev 23 Jul '15

23 Jul '15

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Darwin-kernel Digest, Vol 12, Issue 30
by Slava Imameyev 23 Jul '15

23 Jul '15

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Darwin-kernel Digest, Vol 12, Issue 30
by Prokash Sinha 22 Jul '15

22 Jul '15

So you mean - (1) You have somewhere in your 10.9.5 machine the “Kernel Debugger Kits”. (2) You were able to mount that dmg file. Right? I’m having problem in that, not in hooking a debugger using whatever means. So the question is how to mount “Kernel Debugger kits” for 10.10.N on a 10.9 machine. /Pro On Jul 22, 2015, at 12:00 PM, darwin-kernel-request(a)lists.apple.com wrote: > Send Darwin-kernel mailing list submissions to > darwin-kernel(a)lists.apple.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.apple.com/mailman/listinfo/darwin-kernel > or, via email, send a message with subject or body 'help' to > darwin-kernel-request(a)lists.apple.com > > You can reach the person managing the list at > darwin-kernel-owner(a)lists.apple.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Darwin-kernel digest..." > > > Today's Topics: > > 1. Why the debugger machine ( source ) has to be Yosemeti for > target being Yosemeti (Prokash Sinha) > 2. Re: Why the debugger machine ( source ) has to be Yosemeti > for target being Yosemeti (Slava Imameyev) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 22 Jul 2015 08:53:23 -0700 > From: Prokash Sinha <prokash(a)garlic.com> > To: darwin-kernel(a)lists.apple.com > Subject: Why the debugger machine ( source ) has to be Yosemeti for > target being Yosemeti > Message-ID: <5009D9E5-A1E3-4AC5-B51F-270B64153EB3(a)garlic.com> > Content-Type: text/plain; charset=us-ascii > > Hi All, > The kernel debug kit that is required to debug a Yosemeti target can not be mounted on the source(debugger) machine running 10.9. > > Why is this ? > > Thanks, > Pro > > > ------------------------------ > > Message: 2 > Date: Thu, 23 Jul 2015 02:48:27 +1000 > From: Slava Imameyev <slava.imameev(a)gmail.com> > To: Prokash Sinha <prokash(a)garlic.com> > Cc: darwin-kernel(a)lists.apple.com > Subject: Re: Why the debugger machine ( source ) has to be Yosemeti > for target being Yosemeti > Message-ID: > <CAL1HevaUPQ7jr-yLwsBrLWQ+1c-Yr8QVT=PiDmHCFNf8YMgRxQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > There is no such requirement. I use lldb via FireWire on 10.9.5(Mavericks) > to debug 10.10(Yosemite). > > On Thu, Jul 23, 2015 at 1:53 AM, Prokash Sinha <prokash(a)garlic.com> wrote: > >> Hi All, >> The kernel debug kit that is required to debug a Yosemeti target can not >> be mounted on the source(debugger) machine running 10.9. >> >> Why is this ? >> >> Thanks, >> Pro >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> >> https://lists.apple.com/mailman/options/darwin-kernel/slava.imameev%40gmail… >> >> This email sent to slava.imameev(a)gmail.com >

1 0

Re: Why the debugger machine ( source ) has to be Yosemeti for target being Yosemeti
by Slava Imameyev 22 Jul '15

22 Jul '15

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Why the debugger machine ( source ) has to be Yosemeti for target being Yosemeti
by Prokash Sinha 22 Jul '15

22 Jul '15

Hi All, The kernel debug kit that is required to debug a Yosemeti target can not be mounted on the source(debugger) machine running 10.9. Why is this ? Thanks, Pro _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing per-process information between KAUTH calls
by Stan Sieler 15 Jul '15

15 Jul '15

(possible dup … if it is a dup, blame Yosemite’s Mac Mail :) I’m interested if there’s an answer for this … I invented/implemented this (a method for vendors/implementors to store process local data) for the MPE/V and MPE/iX operating systems a quarter of a century ago (makes 25 years sound so much longer :) and I’d be happy to revise it and post it as an enhancement request. thanks, Stan Sieler sieler(a)allego.com > On Jul 15, 2015, at 5:42 AM, Misha Pak <darwin-kernel(a)oktavist.com> wrote: > > Guys > (Sorry if this has been asked before): > > Is there somewhere a place (per-process!!) where I can store some magic data for a particular process when a KAUTH_FILEOP_EXEC action occurs, and then checking that data when I receive some VNODE KAUTH operation? > We need this since we do behavioral decisions based on some criteria set during process startup. We need to have a way for a VNODE KAUTH op. to know whether to do our stuff or not based upon a decision which occurred earlier, when the process was invoked. > > I tried looking at some "opaque", user-writable areas in the "proc" struct but to no avail. > So if there is no such placeholder, does anyone have another idea? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0