6 ms·

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic

by _ZeD_ 11y ago

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. Can someone explain it to me?

mateuszf 11y ago
Some parts of the system are write protected. You have to disable that as a root and restart system, then you are allowed to modify these parts.
Someone 11y ago
https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899, https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection, https://derflounder.wordpress.com/2015/10/01/system-integrity-protection-adding-another-layer-to-apples-security-model/ https://derflounder.wordpress.com/2015/10/01/system-integrit...
- chris_wot 11y ago
  So what Apple have designed is a "system integrity protection" system that actively prevents you from mitigating security issues. Only a very large company could come up with such an amazingly awful idea. I can just imagine the meeting where this was decided that it would "protect" users where someone said "Freeze all the system binaries even from the end users, that will make them more secure!".
  - hrrsn 11y ago
    It can be disabled. For regular users without git on their systems, it still makes plenty of sense.
    - chris_wot 11y ago
      It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?
      - comex 11y ago
        Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.
        chris_wot 11y ago
        Wow, my innocent question seems to have pissed off a few people! Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated? But not making it easy to update flawed software sounds like a great vector for malware.
        comex 11y ago
        Sorry if I came across that way myself. As for updates - I'm not sure; I should figure that out when I have the chance.
        chris_wot 11y ago
        :-) all good - I'm more curious to know how Apple updates their operating system. Evidently it's possible to modify these protected files, I'm now curious how they do it. Best I can find is the following article: https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-dynamically-disable-and-enable-sip-in-el-capitan/ https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-d...
        acdha 11y ago
        They didn't change the user experience in any way - most updates do not require a reboot, the ones which do are fast - so I'm guessing that the kernel checks the code signature on the process doing the write when deciding what to block and possibly even requires a valid Apple signature on the new file.
shirro 11y ago
On my Chromebook, a linux system, the root filesystem is mounted read only. To modify a file in /usr/bin I would need to activate developer mode then remount it rw. I expect this is probably something similar and done for similar reasons. The big market isn't developers but end users who have no idea how to protect themselves from real threats and who don't use git. And for them sandboxing, signed executables, verified boots and other measures make life far better. If you are a developer using a Mac you most likely use brew or some sort of vm/container system anyway.
ubernostrum 11y ago
Starting in OS X El Capitan there's a framework to protect sensitive system files which disallows even root from modifying them. The only way to make changes is to (as root) disable that framework, then reboot, make the changes, re-enable and reboot again.
klue07 11y ago
There were a 2 talks at syscan360 on SIP. I'm still waiting for the slides to come out. https://www.syscan360.org/en/speakers/ https://www.syscan360.org/en/speakers/
sleepybrett 11y ago
CoreOS also does this, much of the base system is mounted read-only.

by _ZeD_ 11y ago

mateuszf 11y ago

Some parts of the system are write protected. You have to disable that as a root and restart system, then you are allowed to modify these parts.

Someone 11y ago

https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899, https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection, https://derflounder.wordpress.com/2015/10/01/system-integrity-protection-adding-another-layer-to-apples-security-model/ https://derflounder.wordpress.com/2015/10/01/system-integrit...

chris_wot 11y ago
So what Apple have designed is a "system integrity protection" system that actively prevents you from mitigating security issues. Only a very large company could come up with such an amazingly awful idea. I can just imagine the meeting where this was decided that it would "protect" users where someone said "Freeze all the system binaries even from the end users, that will make them more secure!".
- hrrsn 11y ago
  It can be disabled. For regular users without git on their systems, it still makes plenty of sense.
  - chris_wot 11y ago
    It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?
    - comex 11y ago
      Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.
      - chris_wot 11y ago
        Wow, my innocent question seems to have pissed off a few people! Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated? But not making it easy to update flawed software sounds like a great vector for malware.
        comex 11y ago
        Sorry if I came across that way myself. As for updates - I'm not sure; I should figure that out when I have the chance.
        chris_wot 11y ago
        :-) all good - I'm more curious to know how Apple updates their operating system. Evidently it's possible to modify these protected files, I'm now curious how they do it. Best I can find is the following article: https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-dynamically-disable-and-enable-sip-in-el-capitan/ https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-d...
        acdha 11y ago
        They didn't change the user experience in any way - most updates do not require a reboot, the ones which do are fast - so I'm guessing that the kernel checks the code signature on the process doing the write when deciding what to block and possibly even requires a valid Apple signature on the new file.

shirro 11y ago

On my Chromebook, a linux system, the root filesystem is mounted read only. To modify a file in /usr/bin I would need to activate developer mode then remount it rw. I expect this is probably something similar and done for similar reasons. The big market isn't developers but end users who have no idea how to protect themselves from real threats and who don't use git. And for them sandboxing, signed executables, verified boots and other measures make life far better. If you are a developer using a Mac you most likely use brew or some sort of vm/container system anyway.

ubernostrum 11y ago

Starting in OS X El Capitan there's a framework to protect sensitive system files which disallows even root from modifying them. The only way to make changes is to (as root) disable that framework, then reboot, make the changes, re-enable and reboot again.

klue07 11y ago

There were a 2 talks at syscan360 on SIP. I'm still waiting for the slides to come out. https://www.syscan360.org/en/speakers/ https://www.syscan360.org/en/speakers/

sleepybrett 11y ago

CoreOS also does this, much of the base system is mounted read-only.