5 ms·

> To allow it to process the rm command, I had to make a copy of the executable into a temporary directory and execute that. To be clear this is due to SIP.

y4mi 9y ago
You should really spell out the full term if the acronym is predominantly used somewhere else. Unless I'm wrong and you're actually talking about the session initiation protocol (voice over ip)... But that makes little sense It's probably System Integrity Protection, right?
- jessemillar 9y ago
  I believe you are correct. System Integrity Protection is likely what they meant.
deleted 9y ago
[deleted]
floatboth 9y ago
I wonder why did Apple block tracing SIP protected programs? Like, wasn't SIP supposed to protect against their modification on disk, like NetBSD's veriexec? How would DTracing rm be dangerous?
- saagarjha 9y ago
  Because then people could trace rm in a way that allowed them to run arbitrary code in that process. It's the same issue you'd have if you attached a debugger to the process or loaded a dynamic library in their address space.
  - lathiat 9y ago
    That is not true, dtrace cannot modify data and is specifically designed not to do so. It can however be used to leak information or read info out of other processes. I was going to say that for this reason even on linux you can't ptrace processes that are not children of the current process (e.g. you can run something under strace, but not attach to an existing process unless you twiddle a flag or do it as root). Having said that, you CAN modify data with ptrace, unlike dtrace. So that's kindof an aside. In any case the idea is that one process can't hijack another even from the same user for ptrace.
    - saagarjha 9y ago
      As far as I was aware, dtrace lets you perform essentially arbitrary reads/writes of process memory using copyin and copyout. Is this not true?
      - lathiat 9y ago
        It appears you are correct. TIL. There are a few “destructive actions” that can be enabled with a DTrace flag and also require appropriate system permissions. Never the less.

y4mi 9y ago

You should really spell out the full term if the acronym is predominantly used somewhere else. Unless I'm wrong and you're actually talking about the session initiation protocol (voice over ip)... But that makes little sense It's probably System Integrity Protection, right?

jessemillar 9y ago
I believe you are correct. System Integrity Protection is likely what they meant.

deleted 9y ago

[deleted]

floatboth 9y ago

I wonder why did Apple block tracing SIP protected programs? Like, wasn't SIP supposed to protect against their modification on disk, like NetBSD's veriexec? How would DTracing rm be dangerous?

saagarjha 9y ago
Because then people could trace rm in a way that allowed them to run arbitrary code in that process. It's the same issue you'd have if you attached a debugger to the process or loaded a dynamic library in their address space.
- lathiat 9y ago
  That is not true, dtrace cannot modify data and is specifically designed not to do so. It can however be used to leak information or read info out of other processes. I was going to say that for this reason even on linux you can't ptrace processes that are not children of the current process (e.g. you can run something under strace, but not attach to an existing process unless you twiddle a flag or do it as root). Having said that, you CAN modify data with ptrace, unlike dtrace. So that's kindof an aside. In any case the idea is that one process can't hijack another even from the same user for ptrace.
  - saagarjha 9y ago
    As far as I was aware, dtrace lets you perform essentially arbitrary reads/writes of process memory using copyin and copyout. Is this not true?
    - lathiat 9y ago
      It appears you are correct. TIL. There are a few “destructive actions” that can be enabled with a DTrace flag and also require appropriate system permissions. Never the less.