3 ms·
I have a feeling this is EXTREMELY DANGEROUS to have on your Mac. Using DYLD_INSERT_LIBRARIES and attacker could inject code that swizzles -[LAContext evaluateP
by sjtgraham 10y ago
I have a feeling this is EXTREMELY DANGEROUS to have on your Mac. Using DYLD_INSERT_LIBRARIES and attacker could inject code that swizzles -[LAContext evaluatePolicy: localizedReason:reply] to always invoke the callback block with success set to YES. e.g.
DYLD_FORCE_FLAT_NAMESPACE=1 DYLD_INSERT_LIBRARIES=evil.dylib my_sudo rekt
This won't work on SIP protected binaries (n.b. system binaries), but might still work on other binaries while SIP is enabled. It's mostly moot however as many developers have SIP disabled.
- pasyormie 10y agoThis would not work. setuid binaries do not respect these flags, for obvious reasons. But if you're at the point where you can inject environment vars into a devs workstation, it's probably too late for that dev.
- sjtgraham 10y agoYou're right. I had a suspicion of this (hence the non-committal "I have a feeling") but a quick Google search before writing the comment didn't yield much. After seeing your reply I looked at the dyld source: http://opensource.apple.com//source/dyld/dyld-210.2.3/src/dyld.cpp http://opensource.apple.com//source/dyld/dyld-210.2.3/src/dy..., see the function pruneEnvironmentVariables.
- conradev 10y agoApps can also opt-in to only load dynamic libraries with the same Team ID, or signer: https://developer.apple.com/library/content/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW9 https://developer.apple.com/library/content/documentation/Se...