6 ms·

It can be disabled. For regular users without git on their systems, it still makes plenty of sense.

by hrrsn 11y ago

chris_wot 11y ago
It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?
- comex 11y ago
  Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.
  - chris_wot 11y ago
    Wow, my innocent question seems to have pissed off a few people! Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated? But not making it easy to update flawed software sounds like a great vector for malware.
    - comex 11y ago
      Sorry if I came across that way myself. As for updates - I'm not sure; I should figure that out when I have the chance.
      - chris_wot 11y ago
        :-) all good - I'm more curious to know how Apple updates their operating system. Evidently it's possible to modify these protected files, I'm now curious how they do it. Best I can find is the following article: https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-dynamically-disable-and-enable-sip-in-el-capitan/ https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-d...
    - acdha 11y ago
      They didn't change the user experience in any way - most updates do not require a reboot, the ones which do are fast - so I'm guessing that the kernel checks the code signature on the process doing the write when deciding what to block and possibly even requires a valid Apple signature on the new file.
      - chris_wot 11y ago
        Yeah, it's looking increasingly that way. I'd still love to know their thinking behind put git into a directory that SIP makes deliberately hard to update! I mean, git is additional software and not even part of their base operating system, my understanding about SIP was that it was meant to prevent people from tampering with the underlying system software and installing rootkits. git (and ssh for that matter) aren't going cause rootkits by themselves - and all they are doing is forcing people to use homebrew to install versions that's aren't protected by SIP!
        acdha 11y ago
        I think the idea is that they protect everything which they ship, so you can add other things but not replace Apple-provided components. From a sysadmin's perspective this makes a lot of sense: beyond malware, I've seen security and stability problems caused by installers from large companies, developers cowboying up with “sudo make install", etc. but it definitely puts the onus on Apple to ship updates promptly.
        chris_wot 11y ago
        That's the issue I have - not so much an immutable part of the filesystem (though I find that bizarre and flawed), but that Apple don't do enough updates fast enough. I basically think that if Apple want to lock down their ecosystem and prevent folks from updating their own software, then they have a duty to provide timely updates that address security bugs. Currently they don't seem to be doing that.
- anu_gupta 11y ago
  So reboot your machine and disable it if you want. Aren't you able to do that for some reason?
  - chris_wot 11y ago
    Not if I want to update system software for some reason and I'm running a server.
    - anu_gupta 11y ago
      So you install development tools like XCode on a server?
      - chris_wot 11y ago
        Some folks install git on the server, sure. Do you know every single use case of every single server?
        anu_gupta 11y ago
        I'm talking about how you got this version of git on this server. A server that's so mission critical that you're not allowed to reboot it. Why would you install Xcode on such a important box?
        chris_wot 11y ago
        You are missing the wider point I fear. You seem to be so focused on git that you miss the point that there are other system utilities that are installed in /usr that you might need to patch. And if I want to troubleshoot something odd, it would be nice to be able to hook in dtrace - without rebooting the server, flipping a switch to disable the "feature", and then troubleshoot my server's issue.
        anu_gupta 11y ago

It can be disabled. For regular users without git on their systems, it still makes plenty of sense.

by hrrsn 11y ago

It can be disabled. For regular users without git on their systems, it still makes plenty of sense.

It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?

comex 11y ago
Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.
- chris_wot 11y ago
  Wow, my innocent question seems to have pissed off a few people! Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated? But not making it easy to update flawed software sounds like a great vector for malware.
  - comex 11y ago
    Sorry if I came across that way myself. As for updates - I'm not sure; I should figure that out when I have the chance.
    - chris_wot 11y ago
      :-) all good - I'm more curious to know how Apple updates their operating system. Evidently it's possible to modify these protected files, I'm now curious how they do it. Best I can find is the following article: https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-dynamically-disable-and-enable-sip-in-el-capitan/ https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-d...
  - acdha 11y ago
    They didn't change the user experience in any way - most updates do not require a reboot, the ones which do are fast - so I'm guessing that the kernel checks the code signature on the process doing the write when deciding what to block and possibly even requires a valid Apple signature on the new file.
    - chris_wot 11y ago
      Yeah, it's looking increasingly that way. I'd still love to know their thinking behind put git into a directory that SIP makes deliberately hard to update! I mean, git is additional software and not even part of their base operating system, my understanding about SIP was that it was meant to prevent people from tampering with the underlying system software and installing rootkits. git (and ssh for that matter) aren't going cause rootkits by themselves - and all they are doing is forcing people to use homebrew to install versions that's aren't protected by SIP!
      - acdha 11y ago
        I think the idea is that they protect everything which they ship, so you can add other things but not replace Apple-provided components. From a sysadmin's perspective this makes a lot of sense: beyond malware, I've seen security and stability problems caused by installers from large companies, developers cowboying up with “sudo make install", etc. but it definitely puts the onus on Apple to ship updates promptly.
        chris_wot 11y ago
        That's the issue I have - not so much an immutable part of the filesystem (though I find that bizarre and flawed), but that Apple don't do enough updates fast enough. I basically think that if Apple want to lock down their ecosystem and prevent folks from updating their own software, then they have a duty to provide timely updates that address security bugs. Currently they don't seem to be doing that.
anu_gupta 11y ago
So reboot your machine and disable it if you want. Aren't you able to do that for some reason?
- chris_wot 11y ago
  Not if I want to update system software for some reason and I'm running a server.
  - anu_gupta 11y ago
    So you install development tools like XCode on a server?
    - chris_wot 11y ago
      Some folks install git on the server, sure. Do you know every single use case of every single server?
      - anu_gupta 11y ago
        I'm talking about how you got this version of git on this server. A server that's so mission critical that you're not allowed to reboot it. Why would you install Xcode on such a important box?
        chris_wot 11y ago
        You are missing the wider point I fear. You seem to be so focused on git that you miss the point that there are other system utilities that are installed in /usr that you might need to patch. And if I want to troubleshoot something odd, it would be nice to be able to hook in dtrace - without rebooting the server, flipping a switch to disable the "feature", and then troubleshoot my server's issue.
        anu_gupta 11y ago