3 ms·

You can't, not even root can. El Capitan is the only Unix in existence that will not allow root to update files in the /usr/bin directory. Edit: turns out that

You can't, not even root can. El Capitan is the only Unix in existence that will not allow root to update files in the /usr/bin directory. Edit: turns out that I'm wrong, there are plenty of examples - SELinux, Sun had a version, lots and lots of other examples I just didn't look very hard to find them. Sorry if I misled anyone.

cmrx64 11y ago
Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.
- chris_wot 11y ago
  Can you give an example?
  - curt15 11y ago
    Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
    - chris_wot 11y ago
      Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
      - danieldk 11y ago
        Just wanted to say that I appreciate your message and edit. It's great that there are people who are willing to say 'ok, I am wrong'. The suggestion of Kristine1975 upthread works though. /usr/bin/git just runs xcrun to run git from a command-line tools or Xcode installation. Since Xcode is a regular application: % xcrun -f git /Applications/Xcode.app/Contents/Developer/usr/bin/git % sudo mv /Applications/Xcode.app/Contents/Developer/usr/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git.real % sudo ln -sf /bin/ls /Applications/Xcode.app/Contents/Developer/usr/bin/git % git [shows directory contents]
        chris_wot 11y ago
        Thank you :-) You can also do the following (take out the leading spaces...): mkdir -p ~/xcls/usr/bin cat <<EOF > ~/xcls/usr/bin/xcrun #!/bin/sh if [ "\$1" = "git" ]; then shift 1 ls "\$@" exit \$? fi unset DEVELOPER_DIR shift 1 xcrun "\$@" exit \$? EOF chmod a+x ~/xcls/usr/bin/xcrun I get the following: 630188s-iMac:~ 5K$ mkdir ~/testrun 630188s-iMac:~ 5K$ touch ~/testrun/testfile 630188s-iMac:~ 5K$ cd ~/testrun 630188s-iMac:testrun 5K$ DEVELOPER_DIR=~/xcls/ git -l total 0 -rw-r--r-- 1 5K staff 0 8 May 12:03 testfile As you can see, no need for sudo. :-)
- joshumax 11y ago
  The only difference I can tell between SIP and something like SELinux is that SIP enforces filesystem security for any binary that isn't specifically signed by Apple themselves (Which means any Apple signed programs will happily install stuff to /usr/bin), whereas on SELinux the user has a tad more control over the Access Control System, which can either be a good or bad thing depending on the situation.

cmrx64 11y ago

Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.

chris_wot 11y ago
Can you give an example?
- curt15 11y ago
  Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
  - chris_wot 11y ago
    Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
    - danieldk 11y ago
      Just wanted to say that I appreciate your message and edit. It's great that there are people who are willing to say 'ok, I am wrong'. The suggestion of Kristine1975 upthread works though. /usr/bin/git just runs xcrun to run git from a command-line tools or Xcode installation. Since Xcode is a regular application: % xcrun -f git /Applications/Xcode.app/Contents/Developer/usr/bin/git % sudo mv /Applications/Xcode.app/Contents/Developer/usr/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git.real % sudo ln -sf /bin/ls /Applications/Xcode.app/Contents/Developer/usr/bin/git % git [shows directory contents]
      - chris_wot 11y ago
        Thank you :-) You can also do the following (take out the leading spaces...): mkdir -p ~/xcls/usr/bin cat <<EOF > ~/xcls/usr/bin/xcrun #!/bin/sh if [ "\$1" = "git" ]; then shift 1 ls "\$@" exit \$? fi unset DEVELOPER_DIR shift 1 xcrun "\$@" exit \$? EOF chmod a+x ~/xcls/usr/bin/xcrun I get the following: 630188s-iMac:~ 5K$ mkdir ~/testrun 630188s-iMac:~ 5K$ touch ~/testrun/testfile 630188s-iMac:~ 5K$ cd ~/testrun 630188s-iMac:testrun 5K$ DEVELOPER_DIR=~/xcls/ git -l total 0 -rw-r--r-- 1 5K staff 0 8 May 12:03 testfile As you can see, no need for sudo. :-)
joshumax 11y ago
The only difference I can tell between SIP and something like SELinux is that SIP enforces filesystem security for any binary that isn't specifically signed by Apple themselves (Which means any Apple signed programs will happily install stuff to /usr/bin), whereas on SELinux the user has a tad more control over the Access Control System, which can either be a good or bad thing depending on the situation.