June 2016 - Darwin-kernel - lists.apple.com

Signature validation
by David Tay 16 Jun '16

16 Jun '16

Run csrutil disable in terminal after booting to the recovery partition. David Sent from my iPhone > On Jun 16, 2016, at 12:00, darwin-kernel-request(a)lists.apple.com wrote: > > Send Darwin-kernel mailing list submissions to > darwin-kernel(a)lists.apple.com > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.apple.com/mailman/listinfo/darwin-kernel > or, via email, send a message with subject or body 'help' to > darwin-kernel-request(a)lists.apple.com > > You can reach the person managing the list at > darwin-kernel-owner(a)lists.apple.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Darwin-kernel digest..." > > > Today's Topics: > > 1. Signature validation in MacOs (10.12) beta (Prokash Sinha) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 16 Jun 2016 09:20:59 -0700 > From: Prokash Sinha <prokash(a)garlic.com> > To: darwin-kernel(a)lists.apple.com > Subject: Signature validation in MacOs (10.12) beta > Message-ID: <CEB5984F-C876-4297-957D-624C2D1B017C(a)garlic.com> > Content-Type: text/plain; charset="utf-8" > > Hi All, > > Has anybody experienced signature problem on this beta version, for kext that has valid signature in prior version, like 10.11. > > > $ kextutil The.kext > > Code Signing Failure: code signature is invalid > Untrusted kexts are not allowed > ERROR: invalid signature for com.xxx.yyy.zzz, will not load > > > Thanks, > Prokash >

1 0

Signature validation in MacOs (10.12) beta
by Prokash Sinha 16 Jun '16

16 Jun '16

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5
by Gordo Cath 03 Jun '16

03 Jun '16

Hi Quinn, I don't want to run as root but if I do run as root, it runs fine. the big picture is I'm wanting to insert my code into the third party app so I can monitor its events. Then when certain events occur, respond to them. I know how to monitor events and to setup the responders, I just can't seem to get past these APIs when I'm not a root user from what I can tell. I'm wondering if in the original example if I was doing something inherently wrong? I was basically following the steps presented by the man taskgated . GC > -------Original Message------- > From: Quinn The Eskimo! <eskimo1(a)apple.com> > To: Apple Darwin Kernel list <darwin-kernel(a)lists.apple.com> > Subject: Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5 > Sent: Jun 03 '16 08:39 > > > On 3 Jun 2016, at 13:29, Gordo Cath <ds(a)y23.org> wrote: > > > I would have though the nvram kext-dev-mode=1 would have let me past that? or does that flag not work for applications? > > `kext-dev-mode` is only relevant to KEXTs. > > > So in one case i started the first process, a true 64 bit process from my userid. and the second process is my own custom 64 bit application. However the first process is third party, as I do not have access to their source. > > What’s the high-level goal here? What is your process trying to do to this other process? > > * * * > > It seems to me that you’re approaching this from a traditional UNIX perspective, where all processes owned by a particular user are essentially equal. This is not true on Darwin because all of our platforms require us to protect app A from app B even though A and B are run by the same user. This is central to all iOS-based platforms, but it also applies to OS X when you consider sandboxing. > > In some cases you can bypass this restriction by running as root but even that’s not guaranteed. Consider this: > > $ sw_vers > ProductName: Mac OS X > ProductVersion: 10.11.5 > BuildVersion: 15F34 > $ sudo lldb > Password: ******** > (lldb) process attach -n Finder > error: attach failed: cannot attach to process due to System Integrity Protection > > System Integrity Protection on 10.11 and later prevents `task_for_pid` from targeting certain processes even if it’s called as root. > > Share and Enjoy > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ds%40y23.org > > This email sent to ds(a)y23.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5
by Quinn "The Eskimo!" 03 Jun '16

03 Jun '16

On 3 Jun 2016, at 13:29, Gordo Cath <ds(a)y23.org> wrote: > I would have though the nvram kext-dev-mode=1 would have let me past that? or does that flag not work for applications? `kext-dev-mode` is only relevant to KEXTs. > So in one case i started the first process, a true 64 bit process from my userid. and the second process is my own custom 64 bit application. However the first process is third party, as I do not have access to their source. What’s the high-level goal here? What is your process trying to do to this other process? * * * It seems to me that you’re approaching this from a traditional UNIX perspective, where all processes owned by a particular user are essentially equal. This is not true on Darwin because all of our platforms require us to protect app A from app B even though A and B are run by the same user. This is central to all iOS-based platforms, but it also applies to OS X when you consider sandboxing. In some cases you can bypass this restriction by running as root but even that’s not guaranteed. Consider this: $ sw_vers ProductName: Mac OS X ProductVersion: 10.11.5 BuildVersion: 15F34 $ sudo lldb Password: ******** (lldb) process attach -n Finder error: attach failed: cannot attach to process due to System Integrity Protection System Integrity Protection on 10.11 and later prevents `task_for_pid` from targeting certain processes even if it’s called as root. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5
by Gordo Cath 03 Jun '16

03 Jun '16

Hi Quinn, Thanks for the reply. I'm afraid I badly worded that sentence. when I said I 'own' , I really should have said I started both processes with the same userid. So in one case i started the first process, a true 64 bit process from my userid. and the second process is my own custom 64 bit application. However the first process is third party, as I do not have access to their source. I tried experimenting with codesign on my own custom app and have not succeeded down that path yet. I would have though the nvram kext-dev-mode=1 would have let me past that? or does that flag not work for applications? Thanks GC > -------Original Message------- > From: Quinn The Eskimo! <eskimo1(a)apple.com> > To: Apple Darwin Kernel list <darwin-kernel(a)lists.apple.com> > Subject: Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5 > Sent: Jun 03 '16 04:55 > > > On 2 Jun 2016, at 19:58, Gordo Cath <ds(a)y23.org> wrote: > > > What do I need to do to be able to call … task_for_pid successfully without being a su? I own both tasks that one I am and the remote task … > > Modern versions of OS X have this locked down quite tightly. If you control both of the tasks the best option is to arrange to have the target task pass its task control port to the task calling task_for_pid via Mach IPC (or something that supports Mach name passing). That approach is likely to be compatible in the long term. > > Share and Enjoy > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ds%40y23.org > > This email sent to ds(a)y23.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5
by Quinn "The Eskimo!" 03 Jun '16

03 Jun '16

On 2 Jun 2016, at 19:58, Gordo Cath <ds(a)y23.org> wrote: > What do I need to do to be able to call … task_for_pid successfully without being a su? I own both tasks that one I am and the remote task … Modern versions of OS X have this locked down quite tightly. If you control both of the tasks the best option is to arrange to have the target task pass its task control port to the task calling task_for_pid via Mach IPC (or something that supports Mach name passing). That approach is likely to be compatible in the long term. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

task_for_pid and host_processor_set_priv failing on Yosemite 10.10.5
by Gordo Cath 02 Jun '16

02 Jun '16

Hi, I'm working with Yosemite 10.10.5 and am getting an error of invalid argument when i call host_processor_set_priv. Here is the background: snippet... pid_t targetPid; mach_port_t remoteTask=0; err = task_for_pid(mach_task_self(), targetPid, &remoteTask); When I tried calling this I got err=5 I tried adding my user to procmod and procview groups but that had no effect. I also tried adding flags to my Info.plist file: <key>SecTaskAccess</key> <array> <string>allowed</string> <string>safe</string> </array> This had no effect. I'm using the nvram boot-args="kext-dev-mode=1" setting so I don't have to sign. I also modified taskgated.plist so that it starts up with -p -s at boot time. I check it with the ps command and it is now running with -p -s . However all these changs have no effect on the issue. I'm just running as a normal user. I then started down an alternate approach. mach_port_t me=mach_host_self(); // this works mach_port_t psDef; mach_port_t psDefCtl; kern_return_t k; processor_set_default(me, &psDef); //Appears to work k = host_processor_set_priv(me, psDef, &psDefCtl); // Fails ==> k is set to 4 (invalid argument) If I run as su it runs fine. Why do I get this error when I want to run as a normal user? How do I get around it? What do I need to do to be able to call host_processor_set_priv or task_for_pid successfully without being a su? I own both tasks that one I am and the remote task, htey are just separate processes. Side note: Over in the authorizations.plist under system.privilege.taskport are a bunch of key/value pairs. Is there any documentation anywhere? In particular I found a k/v pair of class/allow do I need to add a 'safe' to this somehow? the manpage for taskgated mentions safe being necessary but I don't see a good way to add it there as I don't know by what mechanism to add it. If the solution is here, do I need to make the value portion an <array> of <string> values? GC _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0