3 ms·

Wow... I just re-read the page and saw what you have to do to create /usr/local and that is insane. Reboot into recovery mode?!? W.T.F?

eddieroger 11y ago
Most Mac users will never need to do this, and the short reboot cycle is, to many, worth the extra security rootless brings. It's hardly WTF.
- lsaferite 11y ago
  Being required to reboot my computer into recovery mode just to add a directory is certainly a WTF worthy situation. BTW, thanks for the down vote?
  - oddevan 11y ago
    To add a directory to a system-protected directory. It's all about protecting the integrity of the installed system. If you don't like/want it, you can reboot into recovery, disable it, and leave it that way.
    - Karunamon 11y ago
      The integrity of the installed system could be violated by creating a directory? My system was plenty protected already - it had a root account with a password only I knew. This is just more annoying Apple gatekeeping.
      - _Ogre 11y ago
        Your system is much more secure with SIP in place because it makes big parts of your system immune to trojans and privilege escalation attacks, the two biggest ways malware creeps into your filesystem. It's not very difficult to disable (even permanently if you are inclined), and offers a big security boost. And yes, it is Apple "Gatekeeping"... the same gatekeeping that's kept OS X almost completely free of major hacks for over a decade. I don't consider that annoying but to each his own.
    - aianus 11y ago
      > It's all about protecting the integrity of the installed system Why is this important? It's trivial to reformat my drive and have a fresh install. The stuff I have that's actually sensitive is in my home directory and still unprotected =/
  - ghshephard 11y ago
    99.99% of users will never need to touch those system directories, (They aren't even required for homebrew), and, at the same time, writing to them poses a huge gaping security hole for all OS X users. Locking them down (particularly in a way that can be trivially reversed with a user who has physical possession of the device and the password) is the right thing to do. For the 0.01% who need to screw around with the operating system directories, they can take the 90 seconds to hop into recovery mode. This is a situation where 100% of the user community has a reasonable solution, 99.99% aren't inconvenienced in the slightest, and the security situation goes up significantly. It's like hiding ~/Library by default - 99% of users probably don't need to mess around there, and hiding it probably reduced a lot of failure modes. (and, once again, for the 1%, chflags solves the problem in 5 seconds) Honestly - I've always been terrified whenever I've been asked for my password during installation (I do a gut check every time an ARQ upgrades asks me for my password - "Do I trust them one more time? Well, they are my backup software, so, ...) - What if it's dropping something in my system directory? I usually follow up with a cd /; sudo find -cmin -5 to see if things look reasonable - but I'm guess not all users do that. Also - with all the extended attr stuff on OS X, it's not even clear that a find -cmin -5 would be sufficient. So - count me in the group that is really, really pleased that Apple is locking down those system directories by default.
    - JadeNB 11y ago
      > cd /; sudo find -cmin -5 Sorry, but I can't resist mentioning that there's no need for that `cd /`; `sudo find / -cmin -5` would work just fine.
  - rattray 11y ago
    From the hn guidelines: > Please resist commenting about being downvoted. It never does any good, and it makes boring reading. (though personally I'm not sure why you were downvoted originally)
    - lsaferite 11y ago
      Yeah, I couldn't resist. I never understand down-voting something you disagree with so I'm shocked each time it happens to me as I rarely down-vote people myself. I just wish someone would require you enter a reason for down-voting.
  - s73v3r 11y ago
    No, it's not. Mainly because it's not just "adding a directory"
    - lsaferite 11y ago
      "mkdir /usr/local" is just making a directory. It's not like that suddenly triggers your battery to overheat and explode.
      - s73v3r 11y ago
        Again, no it's not. Unless you just want to ignore everything about where you're making that directory.
tptacek 11y ago
"T.F." is that /usr is immutable under SIP, so if you somehow manage to nuke /usr/local, you have to disable it to put it back. This is a good feature, and it's not a new one: the BSDs have done it for over a decade with securelevels and immutable mounts --- where you also had to take the system down to make alterations. If you think about it for a second, you'll see that anything that would have allowed you, a normal user typing at the keyboard, to create directories under /usr would probably render the security of SIP meaningless. It's the fact that you do have to go into recovery mode to hack up your filesystem that indicates that there's actually a meaningful security check happening here. Just think of SIP's filesystem protections as literally just being "you have to boot the system into a special mode to change certain parts of the filesystem". I want that feature, and I hack up my filesystem all the time! The overwhelming majority of Mac users don't even know they want the feature and benefit enormously from it regardless. A major win.

eddieroger 11y ago

Most Mac users will never need to do this, and the short reboot cycle is, to many, worth the extra security rootless brings. It's hardly WTF.

lsaferite 11y ago
Being required to reboot my computer into recovery mode just to add a directory is certainly a WTF worthy situation. BTW, thanks for the down vote?
- oddevan 11y ago
  To add a directory to a system-protected directory. It's all about protecting the integrity of the installed system. If you don't like/want it, you can reboot into recovery, disable it, and leave it that way.
  - Karunamon 11y ago
    The integrity of the installed system could be violated by creating a directory? My system was plenty protected already - it had a root account with a password only I knew. This is just more annoying Apple gatekeeping.
    - _Ogre 11y ago
      Your system is much more secure with SIP in place because it makes big parts of your system immune to trojans and privilege escalation attacks, the two biggest ways malware creeps into your filesystem. It's not very difficult to disable (even permanently if you are inclined), and offers a big security boost. And yes, it is Apple "Gatekeeping"... the same gatekeeping that's kept OS X almost completely free of major hacks for over a decade. I don't consider that annoying but to each his own.
  - aianus 11y ago
    > It's all about protecting the integrity of the installed system Why is this important? It's trivial to reformat my drive and have a fresh install. The stuff I have that's actually sensitive is in my home directory and still unprotected =/
- ghshephard 11y ago
  99.99% of users will never need to touch those system directories, (They aren't even required for homebrew), and, at the same time, writing to them poses a huge gaping security hole for all OS X users. Locking them down (particularly in a way that can be trivially reversed with a user who has physical possession of the device and the password) is the right thing to do. For the 0.01% who need to screw around with the operating system directories, they can take the 90 seconds to hop into recovery mode. This is a situation where 100% of the user community has a reasonable solution, 99.99% aren't inconvenienced in the slightest, and the security situation goes up significantly. It's like hiding ~/Library by default - 99% of users probably don't need to mess around there, and hiding it probably reduced a lot of failure modes. (and, once again, for the 1%, chflags solves the problem in 5 seconds) Honestly - I've always been terrified whenever I've been asked for my password during installation (I do a gut check every time an ARQ upgrades asks me for my password - "Do I trust them one more time? Well, they are my backup software, so, ...) - What if it's dropping something in my system directory? I usually follow up with a cd /; sudo find -cmin -5 to see if things look reasonable - but I'm guess not all users do that. Also - with all the extended attr stuff on OS X, it's not even clear that a find -cmin -5 would be sufficient. So - count me in the group that is really, really pleased that Apple is locking down those system directories by default.
  - JadeNB 11y ago
    > cd /; sudo find -cmin -5 Sorry, but I can't resist mentioning that there's no need for that `cd /`; `sudo find / -cmin -5` would work just fine.
- rattray 11y ago
  From the hn guidelines: > Please resist commenting about being downvoted. It never does any good, and it makes boring reading. (though personally I'm not sure why you were downvoted originally)
  - lsaferite 11y ago
    Yeah, I couldn't resist. I never understand down-voting something you disagree with so I'm shocked each time it happens to me as I rarely down-vote people myself. I just wish someone would require you enter a reason for down-voting.
- s73v3r 11y ago
  No, it's not. Mainly because it's not just "adding a directory"
  - lsaferite 11y ago
    "mkdir /usr/local" is just making a directory. It's not like that suddenly triggers your battery to overheat and explode.
    - s73v3r 11y ago
      Again, no it's not. Unless you just want to ignore everything about where you're making that directory.

tptacek 11y ago

"T.F." is that /usr is immutable under SIP, so if you somehow manage to nuke /usr/local, you have to disable it to put it back. This is a good feature, and it's not a new one: the BSDs have done it for over a decade with securelevels and immutable mounts --- where you also had to take the system down to make alterations. If you think about it for a second, you'll see that anything that would have allowed you, a normal user typing at the keyboard, to create directories under /usr would probably render the security of SIP meaningless. It's the fact that you do have to go into recovery mode to hack up your filesystem that indicates that there's actually a meaningful security check happening here. Just think of SIP's filesystem protections as literally just being "you have to boot the system into a special mode to change certain parts of the filesystem". I want that feature, and I hack up my filesystem all the time! The overwhelming majority of Mac users don't even know they want the feature and benefit enormously from it regardless. A major win.