site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com For this requirement, the kext must load at system startup. See: I really can't parse: Thanks, -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On Nov 29, 2005, at 4:14 PM, Stephane Sudre wrote: On mercredi, novembre 30, 2005, at 12:31 AM, Terry Lambert wrote: (1) Your kext would need to be loaded and interfaced with the networking stack before the network was in fact enabled, so that no packets were permitted to pass through the networking interace to a potentially vulenrable program on the host system, until the defensive software was in place. To achieve this, you would have to use IOKit matching - the KEXT would need to implement an IOKit device driver, and that driver would have to always claim that it had discovered matching hardware. For this requirement, you would also need to ensure that the kext was loaded before network startup. To achieve this, you would need to claim that the device driver was a "Root" device - that is, it was required in order to mount the Root volume so that the OS was capable of booting; note that making this requirement endangers the system: a bug in this device driver could result in an unrecoverable boot failure requiring either a reinstall, or a boot from install media and an escape to a shell or a boot from an alternate partition. Your point on "Root" device is not exactly right AFAIK. "Root" device startup can be prevented. With some code, the I/O Kernel extension can know that the boot was made in Safe mode and so perform differently or return failure on loading. This is incorrect. In an earlier response, I made the statement that setting "OSBundleRequired" to "Root" was sufficient; I was mistaken, and corrected by Dean; it's *necessary*, but not *sufficient*. To be sufficient, it needs to also be an IOKit driver that claims it has found matching hardware, i.e.: (a) Be an IOKit driver (b) Follow the IOKit matching rules (c) Claim to have matched hardware (d) Have an "OSBundleRequired" of "Root" in its "Info.plist" file (e) *NOT* have a non-zero value for "IOKitDebug" in its "Info.plist" file <http://developer.apple.com/documentation/Darwin/Conceptual/KEXTConcept/KEXTC...
Concerning the point of being loaded before the network stack is enabled, there's a problem in Tiger where the callback which could be used to be loaded before the stack is enabled (so that for instance you can attach socket filters the sooner possible) is never called before the stack is enabled. At least, that's been my experience. This is a known problem AFAIK. "the callback which could be used to be loaded before the stack is enabled" If "used to be" means "formerly was", it doesn't match the verb tense of "is" (should be "was"?), and if "be used" means "carry out a purpose or action", then "to be" probably should have been "is"). If it's the former, I'm not sure I understand why it's a problem to not call a callback on a disabled stack, since disabled stacks don't have any activity on them; if it's the latter, I'm not sure why loading the network extension before enabling the stack is a problem, either, since it seems to be the desired behavior. Do you have a radar # for a problem report that better explains why the Tiger behavior is a problem for you? This email sent to site_archiver@lists.apple.com