3 ms·
I never looked before but "ls /dev/bpf*" shows a lot of Berkeley packet filters. Maybe that reflects a movement toward user-space monitoring?
by Isamu 7y ago
I never looked before but "ls /dev/bpf*" shows a lot of Berkeley packet filters. Maybe that reflects a movement toward user-space monitoring?
- wahern 7y agoInteresting. I get 256 on Catalina (0-255), as opposed to 4 (0-3) on Mojave. /dev doesn't appear to be dynamic as it is on Linux, so they've chosen to pre-create more device files. More importantly, on Catalina the permissions are now ug=rw (0660) and with a group name of "access_bpf", whereas on Mojave they were u=rw (0600) and "wheel". So, yeah, looks like Catalina was a stepping stone.
- codezero 7y agoI think dtrace monitoring can be enabled, but requires removing some system security settings, if I remember correctly, so I guess if they go that route they still need to beef up security.