6 ms·

That still leaves the system git vulnerable, which might be exploitable if you can trick the user into choosing the wrong git binary

by pdpi 11y ago

matt_wulfeck 11y ago
chmod -x /usr/bin/git
- orange_county 11y ago
  You can't even remove execute permissions on it. This was stated in the article as well.
- cuckcuckspruce 11y ago
  That doesn't work for OS 10.11[1]. There's a workaround in that article. [1] http://rachelbythebay.com/w/2016/04/17/unprotected/ http://rachelbythebay.com/w/2016/04/17/unprotected/
- chris_wot 11y ago
  You can't. That's the point!
  - danieldk 11y ago
    sudo chmod a-x $(xcrun -f git) All problems in computer science can be solved by another level of indirection
    - deleted 11y ago
      [deleted]
    - chris_wot 11y ago
      Er... I gain root access and just do: sudo chmod a+x $(xcrun -f git)
Kristine1975 11y ago
Since the system git redirects to the git in Xcode (or whereever Apple's command line tools are installed), copy homebrew's git there. Updating Xcode itself might be easier, though. Edit: Copy homebrew's git into the directory inside the Xcode application where Xcode's outdated git is.
- chris_wot 11y ago
  You can't, not even root can. El Capitan is the only Unix in existence that will not allow root to update files in the /usr/bin directory. Edit: turns out that I'm wrong, there are plenty of examples - SELinux, Sun had a version, lots and lots of other examples I just didn't look very hard to find them. Sorry if I misled anyone.
  - cmrx64 11y ago
    Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.
    - chris_wot 11y ago
      Can you give an example?
      - curt15 11y ago
        Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
        chris_wot 11y ago
        Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
jdeibele 11y ago
Right. And because of System Integrity Protection you have to turn SIP off, remove /usr/bin/git and then turn it back on. Had to do that with Java, which was installed on the family Mac just for Minecraft. Minecraft doesn't require it anymore: http://www.howtogeek.com/210907/minecraft-doesnt-need-java-installed-anymore-its-time-to-remove-it/ http://www.howtogeek.com/210907/minecraft-doesnt-need-java-i... Now that Apple is having a (seemingly) permanent beta option for Mac OS it would be nice if they'd have a developer option that would update much more quickly. And would hopefully have better bug reports ... hopefully.

That still leaves the system git vulnerable, which might be exploitable if you can trick the user into choosing the wrong git binary

by pdpi 11y ago

That still leaves the system git vulnerable, which might be exploitable if you can trick the user into choosing the wrong git binary

matt_wulfeck 11y ago

chmod -x /usr/bin/git

orange_county 11y ago
You can't even remove execute permissions on it. This was stated in the article as well.
cuckcuckspruce 11y ago
That doesn't work for OS 10.11[1]. There's a workaround in that article. [1] http://rachelbythebay.com/w/2016/04/17/unprotected/ http://rachelbythebay.com/w/2016/04/17/unprotected/
chris_wot 11y ago
You can't. That's the point!
- danieldk 11y ago
  sudo chmod a-x $(xcrun -f git) All problems in computer science can be solved by another level of indirection
  - deleted 11y ago
    [deleted]
  - chris_wot 11y ago
    Er... I gain root access and just do: sudo chmod a+x $(xcrun -f git)

Kristine1975 11y ago

Since the system git redirects to the git in Xcode (or whereever Apple's command line tools are installed), copy homebrew's git there. Updating Xcode itself might be easier, though. Edit: Copy homebrew's git into the directory inside the Xcode application where Xcode's outdated git is.

chris_wot 11y ago
You can't, not even root can. El Capitan is the only Unix in existence that will not allow root to update files in the /usr/bin directory. Edit: turns out that I'm wrong, there are plenty of examples - SELinux, Sun had a version, lots and lots of other examples I just didn't look very hard to find them. Sorry if I misled anyone.
- cmrx64 11y ago
  Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.
  - chris_wot 11y ago
    Can you give an example?
    - curt15 11y ago
      Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
      - chris_wot 11y ago
        Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.

jdeibele 11y ago

Right. And because of System Integrity Protection you have to turn SIP off, remove /usr/bin/git and then turn it back on. Had to do that with Java, which was installed on the family Mac just for Minecraft. Minecraft doesn't require it anymore: http://www.howtogeek.com/210907/minecraft-doesnt-need-java-installed-anymore-its-time-to-remove-it/ http://www.howtogeek.com/210907/minecraft-doesnt-need-java-i... Now that Apple is having a (seemingly) permanent beta option for Mac OS it would be nice if they'd have a developer option that would update much more quickly. And would hopefully have better bug reports ... hopefully.