5 ms·

I've noticed that Apple has started releasing Darwin sources more often. This is a really huge improvement for security research, since it lets outside research

by snazz 6y ago

I've noticed that Apple has started releasing Darwin sources more often. This is a really huge improvement for security research, since it lets outside researchers see the mitigations and fixes that Apple made to kernel security vulnerabilities quicker. This way, incomplete or otherwise incorrect fixes can be reported to Apple before that kernel version has been in the wild for a long time.

saagarjha 6y ago
As someone who maintains mirrors of Apple's open source releases: eh. They had a week a couple months back where they deleted the download links for every old version of XNU; they've been OK for the last few weeks on opensource.apple.com itself but opensource.apple.com/tarballs has been slow to update for all projects (I even sent them an email about it!) And it's important to note that a lot of the actual security features that the system relies on (such as much of the sandboxing code) is not included in the open source release at all.
- snazz 6y ago
  I've been using https://github.com/clemensg/xnu https://github.com/clemensg/xnu to look through the releases and there's definitely been an uptick recently (although that particular repo was suddenly updated after I made an issue).
  - saagarjha 6y ago
    I keep mine at https://github.com/apple-open-source-mirror https://github.com/apple-open-source-mirror, but I have not updated it as the new dyld-733.8 tarballs aren't linked yet and I like to keep them all in sync :(
- tannhaeuser 6y ago
  Sorry to hijack but would you know a way to run Darwin from sources as an OS for testing Mac builds (backend and command-line apps without GUI)? Clang and/or gcc would be a plus to have. I've looked at the PureDarwin project but that doesn't seem to provide anything I could use. Apple's update treadmill, notarization, SIP, and other tightening makes Mac OS an increasingly annoying and expensive/time-consuming platform to port software to.
  - snazz 6y ago
    I'm afraid not. I haven't seen anything other than PureDarwin that runs at all modern versions of Darwin. A Hackintosh on a relatively basic system (integrated graphics, nothing strange that isn't in an actual Mac) might be the easiest way for you to do this, although you'll still have to deal with the other things you mentioned.
  - saagarjha 6y ago
    It's not quite what you asked for, but have you tried Darling? If your app is simple enough it might work there. (Compiling Darwin from source is fairly involved, and I'll have to find the Apple engineer who posts instructions on how to build it these days…)
    - tannhaeuser 6y ago
      Thanks, didn't know about that project! I guess this isn't designed to run Mac OS's libc and userspace in a bug-for-bug compatible fashion though and thus wouldn't provide any more info about unique porting issues on Mac OS on top of what's already revealed by cross-compiling.
      - saagarjha 6y ago
        I am unsure if the XNU you can build from public sources can support the userspace the extent necessary to run all those tools. Honestly, I would probably suggest using a Hackintosh as it'd be significantly less work for a higher-fidelity result…
        tannhaeuser 6y ago
        Yeah, thanks, we do have Apple hardware. It's about CI and build automation (or the lack thereof on Mac OS). For example, we can't re-image /reset a Mac into a pristine state easily after manually switching of SIP for CI, but must still end-user test the final product, can't justify the effort to adapt to yearly updates for relatively niche target, can't reasonably save working XCode setups, must test things on current Safari (so have a clean/up-to-date Apple machine around), etc.

by snazz 6y ago

saagarjha 6y ago

As someone who maintains mirrors of Apple's open source releases: eh. They had a week a couple months back where they deleted the download links for every old version of XNU; they've been OK for the last few weeks on opensource.apple.com itself but opensource.apple.com/tarballs has been slow to update for all projects (I even sent them an email about it!) And it's important to note that a lot of the actual security features that the system relies on (such as much of the sandboxing code) is not included in the open source release at all.

snazz 6y ago
I've been using https://github.com/clemensg/xnu https://github.com/clemensg/xnu to look through the releases and there's definitely been an uptick recently (although that particular repo was suddenly updated after I made an issue).
- saagarjha 6y ago
  I keep mine at https://github.com/apple-open-source-mirror https://github.com/apple-open-source-mirror, but I have not updated it as the new dyld-733.8 tarballs aren't linked yet and I like to keep them all in sync :(
tannhaeuser 6y ago
Sorry to hijack but would you know a way to run Darwin from sources as an OS for testing Mac builds (backend and command-line apps without GUI)? Clang and/or gcc would be a plus to have. I've looked at the PureDarwin project but that doesn't seem to provide anything I could use. Apple's update treadmill, notarization, SIP, and other tightening makes Mac OS an increasingly annoying and expensive/time-consuming platform to port software to.
- snazz 6y ago
  I'm afraid not. I haven't seen anything other than PureDarwin that runs at all modern versions of Darwin. A Hackintosh on a relatively basic system (integrated graphics, nothing strange that isn't in an actual Mac) might be the easiest way for you to do this, although you'll still have to deal with the other things you mentioned.
- saagarjha 6y ago
  It's not quite what you asked for, but have you tried Darling? If your app is simple enough it might work there. (Compiling Darwin from source is fairly involved, and I'll have to find the Apple engineer who posts instructions on how to build it these days…)
  - tannhaeuser 6y ago
    Thanks, didn't know about that project! I guess this isn't designed to run Mac OS's libc and userspace in a bug-for-bug compatible fashion though and thus wouldn't provide any more info about unique porting issues on Mac OS on top of what's already revealed by cross-compiling.
    - saagarjha 6y ago
      I am unsure if the XNU you can build from public sources can support the userspace the extent necessary to run all those tools. Honestly, I would probably suggest using a Hackintosh as it'd be significantly less work for a higher-fidelity result…
      - tannhaeuser 6y ago
        Yeah, thanks, we do have Apple hardware. It's about CI and build automation (or the lack thereof on Mac OS). For example, we can't re-image /reset a Mac into a pristine state easily after manually switching of SIP for CI, but must still end-user test the final product, can't justify the effort to adapt to yearly updates for relatively niche target, can't reasonably save working XCode setups, must test things on current Safari (so have a clean/up-to-date Apple machine around), etc.