5 ms·

Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabl

by cmrx64 10y ago

Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.

chris_wot 10y ago
Can you give an example?
- curt15 10y ago
  Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
  - chris_wot 10y ago
    Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
    - danieldk 10y ago
      Just wanted to say that I appreciate your message and edit. It's great that there are people who are willing to say 'ok, I am wrong'. The suggestion of Kristine1975 upthread works though. /usr/bin/git just runs xcrun to run git from a command-line tools or Xcode installation. Since Xcode is a regular application: % xcrun -f git /Applications/Xcode.app/Contents/Developer/usr/bin/git % sudo mv /Applications/Xcode.app/Contents/Developer/usr/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git.real % sudo ln -sf /bin/ls /Applications/Xcode.app/Contents/Developer/usr/bin/git % git [shows directory contents]
      - chris_wot 10y ago
        Thank you :-) You can also do the following (take out the leading spaces...): mkdir -p ~/xcls/usr/bin cat <<EOF > ~/xcls/usr/bin/xcrun #!/bin/sh if [ "\$1" = "git" ]; then shift 1 ls "\$@" exit \$? fi unset DEVELOPER_DIR shift 1 xcrun "\$@" exit \$? EOF chmod a+x ~/xcls/usr/bin/xcrun I get the following: 630188s-iMac:~ 5K$ mkdir ~/testrun 630188s-iMac:~ 5K$ touch ~/testrun/testfile 630188s-iMac:~ 5K$ cd ~/testrun 630188s-iMac:testrun 5K$ DEVELOPER_DIR=~/xcls/ git -l total 0 -rw-r--r-- 1 5K staff 0 8 May 12:03 testfile As you can see, no need for sudo. :-)
joshumax 10y ago
The only difference I can tell between SIP and something like SELinux is that SIP enforces filesystem security for any binary that isn't specifically signed by Apple themselves (Which means any Apple signed programs will happily install stuff to /usr/bin), whereas on SELinux the user has a tad more control over the Access Control System, which can either be a good or bad thing depending on the situation.

by cmrx64 10y ago

Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.

chris_wot 10y ago

Can you give an example?

curt15 10y ago
Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
- chris_wot 10y ago
  Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
  - danieldk 10y ago
    Just wanted to say that I appreciate your message and edit. It's great that there are people who are willing to say 'ok, I am wrong'. The suggestion of Kristine1975 upthread works though. /usr/bin/git just runs xcrun to run git from a command-line tools or Xcode installation. Since Xcode is a regular application: % xcrun -f git /Applications/Xcode.app/Contents/Developer/usr/bin/git % sudo mv /Applications/Xcode.app/Contents/Developer/usr/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git.real % sudo ln -sf /bin/ls /Applications/Xcode.app/Contents/Developer/usr/bin/git % git [shows directory contents]
    - chris_wot 10y ago
      Thank you :-) You can also do the following (take out the leading spaces...): mkdir -p ~/xcls/usr/bin cat <<EOF > ~/xcls/usr/bin/xcrun #!/bin/sh if [ "\$1" = "git" ]; then shift 1 ls "\$@" exit \$? fi unset DEVELOPER_DIR shift 1 xcrun "\$@" exit \$? EOF chmod a+x ~/xcls/usr/bin/xcrun I get the following: 630188s-iMac:~ 5K$ mkdir ~/testrun 630188s-iMac:~ 5K$ touch ~/testrun/testfile 630188s-iMac:~ 5K$ cd ~/testrun 630188s-iMac:testrun 5K$ DEVELOPER_DIR=~/xcls/ git -l total 0 -rw-r--r-- 1 5K staff 0 8 May 12:03 testfile As you can see, no need for sudo. :-)

joshumax 10y ago

The only difference I can tell between SIP and something like SELinux is that SIP enforces filesystem security for any binary that isn't specifically signed by Apple themselves (Which means any Apple signed programs will happily install stuff to /usr/bin), whereas on SELinux the user has a tad more control over the Access Control System, which can either be a good or bad thing depending on the situation.