July 2018 - Darwin-kernel - lists.apple.com

10.14.0+ xnu src
by Prokash Sinha 12 Jul '18

12 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi All, When would the source be available for the above version ? Thanks, Prokash _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Building the 10.13.3 Kernel
by Alexander von Below 12 Jul '18

12 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mac.com; s=04042017; t=1531391246; bh=JSeoMyt9vokDMjgCHx0jMkpLQLfOWWYDmR1jv0sCK2k=; h=From:Content-type:MIME-version:Subject:Message-id:Date:To; b=ZAw/wv+sUcw1ovITV6x8UDbzvDT+hWT8kd0dO8iFnW8HyCUSH7yGfrjUJpohPg9s3 AlEkeJUZ7lWtMx8V0zMLgWAfq+lpIfSZr9Cg9q0xA+JPk7TA7wsanc+kynS/RLJ9gs wzlvm4YYoOpcmeV2xeaTWX19C4NwFyg3td6Crputu77PwPf7rxPH0COc4tUfVPRg+A dyXbAbH1ZR5H8DJGpHMJO2fSRXKX7qo4g182GAqT5z2PViDod0TMDbsOZgUhWG1t3X RUiKhuqFfbgaGCzfX14WXYHlz66DwHLpfYa60XJE3NkwGRP+CyMYeeACoYOrEG+zIt aXHYBeRCLLvKw== Hello, after may years I spent exclusively on iOS, I am happy to be back in the Kernel Space! So, I am trying to build the 10.13.3 Kernel using this script, which I assembled from a few I found on the net (especially the 'touch libsyscall/os/thread_self_restrict.h' „hack"): https://gist.github.com/below/8482f56dd98e1c3802dd436a1e865090 However, I am getting errors, the first one being /Users/below/dev/mptcp/xnu/xnu-4570.41.2/BUILD/obj/EXPORT_HDRS/osfmk/kern/kcdata.h:912:60: error: zero as null pointer constant [-Werror,-Wzero-as-null-pointer-constant] static const kcdata_iter_t kcdata_invalid_iter = { .item = 0, .end = 0 }; ^ nullptr Am I doing it wrong? Am I missing something? Has any one you built the 10.13.3 Kernel succesfully? Thanks Alex _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Prevention of file direct memory reads in xnu kernel - Kauth doesn't enough
by Irad K 05 Jul '18

05 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=3DymFesV2l/S4Z3MPzGjr+cskybk7Xv0fj+Lv+C4JMQ=; b=ZK4mBTa3qd4bSnXPJEl/eQBns54krmPfE78svIQHklU+kO2u9I5/s+UbttVvtvSfAS WXjQCLdtcQLHasrF9+cttvhea7Mu90Iq3csIlmIXP68keIKQiM4raoCBo3e5nhnuES6B rYxpuJCh8XvDu0U33dHq5bWASiSeibfKp+ywkEENa5ctADAJKbItpO+bdddpF8HTegHC T1m2U5oLk2AZ/lbwTzDWFlR/6Pb5CqXX5RrtIGHH8pLhIFnZHTU3Dv+t+CksKxhLkD0B OuvCQJ2Supn7D5si0rS2jQnr9WHH0bTMShsU1mZ0S2omzfvatYf6KVmUPyTQAsVAnELc Q5BA== I've got a dylib file for which I prevent access in kernel level to any other process but my own. To achieve that, I use driver that listen to kauth vnode scope with callback that prevent any access to this file by other process. However, I've noticed that spindump coreSymbolication framework can bypass this authorization flow after 4 retries to access the file (using open syscall), and access the file memory directly as it can be shown in the following backtrace : ------------------------------------------------------------------ ------------------------------------------------------- frame #2: 0xffffff7f87ac4784 IOStorageFamily`dkreadwrite(dkr=0xffffff8062fca3e0, dkrtype=<unavailable>) at IOMediaBSDClient.cpp:2975 [opt] frame #3: 0xffffff80072d8734 kernel`spec_strategy(ap=<unavailable>) at spec_vnops.c:2409 [opt] frame #4: 0xffffff8007282212 kernel`buf_strategy(devvp=<unavailable>, ap=<unavailable>) at vfs_bio.c:1379 [opt] frame #5: 0xffffff800728ad42 kernel`cluster_io [inlined] VNOP_STRATEGY(bp=0xffffff8062fca3e0) at kpi_vfs.c:5696 [opt] frame #6: 0xffffff800728ad0b kernel`cluster_io(vp=0xffffff80145a8c18, upl=0xffffff80107f7700, upl_offset=0x0000000000004000, f_offset=40960, non_rounded_size=0, flags=141, real_bp=<unavailable>, iostate=<unavailable>, callback=<unavailable>, callback_arg=<unavailable>) at vfs_cluster.c:1801 [opt] frame #7: 0xffffff800728b8f5 kernel`cluster_pagein_ext(vp=0xffffff80145a8c18, upl=0xffffff80107f7700, upl_offset=<unavailable>, f_offset=24576, size=<unavailable>, filesize=-549414335464, flags=<unavailable>, callback=<unavailable>, callback_arg=<unavailable>) at vfs_cluster.c:2171 [opt] frame #8: 0xffffff800728b7e5 kernel`cluster_pagein(vp=<unavailable>, upl=<unavailable>, upl_offset=<unavailable>, f_offset=<unavailable>, size=<unavailable>, filesize=<unavailable>, flags=0) at vfs_cluster.c:2116 [opt] frame #9: 0xffffff7f893d60be frame #10: 0xffffff80075a811a kernel`vnode_pagein [inlined] VNOP_PAGEIN(size=24576, flags=341478424, ctx=<unavailable>) at kpi_vfs.c:5273 [opt] frame #11: 0xffffff80075a80d3 kernel`vnode_pagein(vp=0xffffff80145a8c18, upl=<unavailable>, upl_offset=<unavailable>, f_offset=24576, size=<unavailable>, flags=341478424, errorp=<unavailable>) at vnode_pager.c:593 [opt] frame #12: 0xffffff80070dc119 kernel`vnode_pager_cluster_read(vnode_object=0xffffff80145a48e8, base_offset=24576, offset=<unavailable>, io_streaming=<unavailable>, cnt=0x0000000000004000) at bsd_vm.c:851 [opt] frame #13: 0xffffff80070dbe93 kernel`vnode_pager_data_request(mem_obj=0xffffff80145a48e8, offset=24576, length=<unavailable>, desired_access=<unavailable>, fault_info=<unavailable>) at bsd_vm.c:639 [opt] frame #14: 0xffffff80070eb011 kernel`vm_fault_page [inlined] memory_object_data_request(memory_object=<unavailable>, offset=<unavailable>, length=4096, desired_access=1, fault_info=<unavailable>) at memory_object.c:2134 [opt] frame #15: 0xffffff80070eaffb kernel`vm_fault_page(first_object=0xffffff8011d64a00, first_offset=4096, fault_type=1, must_be_resident=0, caller_lookup=0, protection=0xffffff806717be90, result_page=<unavailable>, top_page=<unavailable>, type_of_fault=<unavailable>, error_code=<unavailable>, no_zero_fill=<unavailable>, data_supply=0, fault_info=<unavailable>) at vm_fault.c:1770 [opt] frame #16: 0xffffff80070ef82a kernel`vm_fault_internal(map=<unavailable>, vaddr=<unavailable>, caller_prot=1, change_wiring=<unavailable>, wire_tag=0, interruptible=2, caller_pmap=<unavailable>, caller_pmap_addr=<unavailable>, physpage_p=<unavailable>) at vm_fault.c:4610 [opt] frame #17: 0xffffff8007188f92 kernel`user_trap [inlined] vm_fault(map=<unavailable>, fault_type=<unavailable>, change_wiring=0, wire_tag=0, interruptible=2, caller_pmap_addr=0) at vm_fault.c:3416 [opt] frame #18: 0xffffff8007188f6f kernel`user_trap(saved_state=0xffffff800f07b7a0) at trap.c:1083 [opt] ------------------------------------------------------------------------------------------------------------------------- My question is how it's possible to get memory fault on the file memory without open it first (kauth prevent open syscall). what system call can actually initial the kernel thread whose backtrace listed above ? B.S: First I thought it might be mmap, but I eliminate this option after hooking Mac policy function of mpo_file_check_mmap. Then I tried to look at the trace of spindump when it reads my dylib. it can clearly by shown that the open is failed for 4 times before somehow the spindump manage to read my file. perhaps any of the syscalls that triggered this memory read exists in there, but which one ? CODE: SELECT ALL open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 proc_info(0x2, 0x22C, 0x3) = 136 0 __mac_syscall(0x7FFF7C5FBAC6, 0x2, 0x70000E7AD6F0) = 0 0 proc_info(0x2, 0x22C, 0x3) = 136 0 proc_info(0x2, 0x22C, 0xB) = 0 0 proc_info(0x2, 0x22C, 0x3) = 136 0 proc_info(0x2, 0x1, 0x3) = 136 0 proc_info(0x2, 0x1, 0xB) = 0 0 bsdthread_create(0x7FFF682EDC18, 0x70000E7AE718, 0x80000) = 244015104 0 thread_selfid(0x0, 0x0, 0x0) = 10973 0 psynch_mutexdrop(0x70000E7AE728, 0x203, 0x100) = 0 0 psynch_mutexwait(0x70000E7AE728, 0x203, 0x0) = 515 0 __disable_threadsignal(0x1, 0x0, 0x0) = 0 0 __semwait_signal(0x1A2F, 0x0, 0x0) = 0 0 getattrlist("/Library/MyDir/MyFile.dylib\0", 0x70000E7ADEA0, 0x70000E7AE2A8) = 0 0 geteuid(0x0, 0x0, 0x0) = 0 0 bsdthread_create(0x7FFF682EDC18, 0x70000E7AE7E0, 0x80000) = 244015104 0 thread_selfid(0x0, 0x0, 0x0) = 10974 0 psynch_mutexdrop(0x70000E7AE7F0, 0x203, 0x100) = 0 0 psynch_mutexwait(0x70000E7AE7F0, 0x203, 0x0) = 515 0 geteuid(0x0, 0x0, 0x0) = 0 0 kevent_qos(0xFFFFFFFFFFFFFFFF, 0x70000E8B56B8, 0x1) = 0 0 workq_kernreturn(0x40, 0x70000E938B80, 0x1) = 0 Err#-2 workq_kernreturn(0x20, 0x0, 0x1) = 0 0 workq_kernreturn(0x4, 0x0, 0x0) = 0 Err#-2 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 open("/Library/MyDir/MyFile.dylib\0", 0x0, 0x0) = -1 Err#13 write_nocancel(0x2, "Caught EXC_BAD_ACCESS at 0x10bbc4d84, valid page mapping, page query flags (0x80)\n\0", 0x52) = 82 0 __disable_threadsignal(0x1, 0x0, 0x0) = 0 0 __semwait_signal(0x227B, 0x0, 0x0) = 0 0 write_nocancel(0x2, "Missing page in pid 556, create of symbol owner data for [/Library/MyDir/MyFile.dylib] failed, err code 4098\n\0", 0x81) = 129 0 open_nocancel("/Library/MyDir\0", 0x1100004, 0xE7AD20A) = 4 0 fstatfs64(0x4, 0x70000E7AC028, 0x0) = 0 0 getdirentries64(0x4, 0x7FF8BDAF6800, 0x1000) = -1 Err#5 close_nocancel(0x4) = 0 0 stat64("/Library/MyDir\0", 0x70000E7ADAE0, 0x0) = 0 0 open_nocancel("/Library/MyDir\0", 0x1100004, 0xE7AD60A) = 4 0 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Read current executable even if it's been deleted?
by Alec Mocatta 03 Jul '18

03 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mocatta.net; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:cc; bh=/new6p/LqLe48LTzzdY1MuHv5hVZ7LRDPzPBrYNBNzY=; b=IFVlbgsjkxSt1S/Sdhvkn0c/6gEI+wK/Or7kxVMBHJ0asUSo9f5+i+Thp5T4mniz2d Hf84q3QxQojgT66j+J5dHxKmygl2GCsYjk9Iq+8RTMDJ0N/ciZXh7iXuPMlRhKTLAD1W JMZE2S9QeiEk1ro3cpobntd01xT7KaXYvGuq4= Thank you all, the _dyld_*_image API sounds like it does the job. I'll investigate and post back if I have any issues. Alec On Tue, Jul 3, 2018 at 7:10 PM, N <scandium(a)me.com> wrote: > You can use _dyld_*_image API, see dyld/include/mach-o/dyld.h. Because the > loader does not preserve the on-disk copy of the image in memory, > the resulting image will likely be different from the on-disk image, but > depending on your goal this should not matter. > > > On 3 Jul 2018, at 01:34, Alec Mocatta <alec(a)mocatta.net> wrote: > > > > Linux has a path in the /proc filesystem – /proc/self/exe – which lets > one read the contents of ones own executable, even if it has since been > deleted or was exec'd in an atypical manner (e.g. > execve("/proc/self/fd/123", ...)). > > > > On Darwin/macOS I can use _NSGetExecutablePath() to get the path to the > current executable. The problem is this breaks in the aforementioned cases: > namely deletion/moving. > > > > Is there a way to read the contents of ones own executable, that works > in the face of deletion/moving? > > > > Thanks, > > Alec > > > > _______________________________________________ > > Do not post admin requests to the list. They will be ignored. > > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > > Help/Unsubscribe/Update your Subscription: > > https://lists.apple.com/mailman/options/darwin-kernel/scandium%40me.com > > > > This email sent to scandium(a)me.com > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Read current executable even if it's been deleted?
by N 03 Jul '18

03 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=me.com; s=04042017; t=1530641432; bh=TPFetqqfO2MGNM61SaXhuWUNnmXEnRvJJUaIlUvXtUA=; h=Content-type:MIME-version:Subject:From:Date:Message-id:To; b=Cgs17UofLaD8DWvM52E0k+MAVnpGF7hJN5HnyQz/zWs/vHhi3HA+CltobJ/BTaVpF 4vUJ4EKYHujy/cW+KgE7jPw18Z0C1bd1GtrHovGAsg3n6qRXXmeufdxSWrKYW1aJ8X XEAVpvMIfiXSg6XOOsy5bLOIXwFernmkO6q3QZpi8wLmO1e5RnBExQ/gEBzqZ4FZzu Gk6tL4EcAxE/hOKxDdSmYEwGJANpHM140XiOKb2Pz7mSQMbvLZidky3jlfhTbz5cWK zsLw1Xyo2JT1JtXkZ0JmE4NRKGSjnLz6bVZfbbECDDGXchYU9LRuxPBMy7Dh/N2f3V 567yKoFo2qNlg== You can use _dyld_*_image API, see dyld/include/mach-o/dyld.h. Because the loader does not preserve the on-disk copy of the image in memory, the resulting image will likely be different from the on-disk image, but depending on your goal this should not matter. > On 3 Jul 2018, at 01:34, Alec Mocatta <alec(a)mocatta.net> wrote: > > Linux has a path in the /proc filesystem – /proc/self/exe – which lets one > read the contents of ones own executable, even if it has since been deleted > or was exec'd in an atypical manner (e.g. execve("/proc/self/fd/123", ...)). > > On Darwin/macOS I can use _NSGetExecutablePath() to get the path to the > current executable. The problem is this breaks in the aforementioned cases: > namely deletion/moving. > > Is there a way to read the contents of ones own executable, that works in the > face of deletion/moving? > > Thanks, > Alec > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/scandium%40me.com > > This email sent to scandium(a)me.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Read current executable even if it's been deleted?
by Richard L. Hamilton 03 Jul '18

03 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=DzoirhZ7q2HS8tEITxfV7G3c2Bb8XfagRQkhUN2l80Q=; b=ZL3iiGUnoGC+rcuuReGJcnWznQC40o6Oi3wXGAFyJ4QTkPD9bCao03F+GRz1FM6OSD ypqDonmyWx1rfVl9CLxh8tdClYuwi7qjV58xU7yQn9BpICMa9DsCnkEPstwms+vo1gsL 4xlNAG78WVXgvCKfyGQPlx7dK2bmGxpTQwSmzdNz88NJFARTkrcfepkazJcj0oDz1ENY ECku0NPF9NvzA1lo/QhhZODhBoeN2MYe1f8kC57U/RvgXlqZwrbA7bKSqyEEsx5EVub0 ua4feKxR2wwYiF+6zEMyD0qnr02uQMv63ZQVjiK2YpSAKOblJGfmezpeEeLh6n9cVcIU xbAw== Even on Linux, if the executable is execute-only (no write access), you wouldn't be able to read it via /proc/self/exe (I tried). So even there, there's no guaranteed solution. > On Jul 2, 2018, at 19:34, Alec Mocatta <alec(a)mocatta.net> wrote: > > Linux has a path in the /proc filesystem – /proc/self/exe – which lets one > read the contents of ones own executable, even if it has since been deleted > or was exec'd in an atypical manner (e.g. execve("/proc/self/fd/123", ...)). > > On Darwin/macOS I can use _NSGetExecutablePath() to get the path to the > current executable. The problem is this breaks in the aforementioned cases: > namely deletion/moving. > > Is there a way to read the contents of ones own executable, that works in the > face of deletion/moving? > > Thanks, > Alec > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/rlhamil2%40gmail.com > > This email sent to rlhamil2(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Read current executable even if it's been deleted?
by Alec Mocatta 02 Jul '18

02 Jul '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mocatta.net; s=google; h=mime-version:from:date:message-id:subject:to; bh=IzVlJc1HvmjvAKdcBcXRBdQ0wSuqjycDigz9WgufFno=; b=S7rHY+A2keZB0YddUDmQ8e73xarllqtbVB/JEhhPmwuthf4G5RGwkRmQQv96wqjAO5 wNJA0xz53y0yQb5/Wtds5m8vx6ax31N+beG3KUjwaIUpXzRUJNHrVwztV5CgCd8E9nZ6 7nAAox7sXQXuB5hwHfGM1SeIoNgI2yVMyAs2I= Linux has a path in the /proc filesystem – /proc/self/exe – which lets one read the contents of ones own executable, even if it has since been deleted or was exec'd in an atypical manner (e.g. execve("/proc/self/fd/123", ...)). On Darwin/macOS I can use _NSGetExecutablePath() to get the path to the current executable. The problem is this breaks in the aforementioned cases: namely deletion/moving. Is there a way to read the contents of ones own executable, that works in the face of deletion/moving? Thanks, Alec _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0