4 ms·

Does anyone have a tip to keep macOS from phoning home when you run unsigned binaries? I almost locked up my entire computer this week, presumably because of t

Does anyone have a tip to keep macOS from phoning home when you run unsigned binaries? I almost locked up my entire computer this week, presumably because of this... here's the story for that: I had setup unbound listening on 127.0.0.1:53 as the only DNS resolver for all network interfaces, so that I hijack several responses that I might want to (e.g. adnet sinkholes) and forward the rest to Google/Cloudflare over TLS. When I rebooted the Mac, the entire computer was so fucked that I panicked cause I thought my SSD was failing. Turns out unbound failed to start so all DNS was down. I suspect it to be the "phoning home" because when I opened the Terminal, running `ps aux | grep unbound` took like 5 seconds to return anything (as did everything else that tried to run), and that behavior has been reported by other users as Gatekeeper's Phone Home checks being at fault. So that's why I was wondering if anyone has found out how to keep macOS from doing this (preferably without disabling all of SIP), cause that'd be one hell of a tip...

lunixbochs 6y ago
Edit: removed instructions to disable gatekeeper as sibling comment looks like a much better solution and writeup. I’m also curious if the self signed binaries in Big Sur fix this problem.
- luizfelberti 6y ago
  I'll test that out later today/tomorrow, thanks! I guess the questions I'd have regarding this that I'd need to validate would be: - Does this setting persist across reboots? - Does it stop phoning-home altogether, or will it still phone-home, but always authorize regardless of answer? - Is there a more granular way to disable just phoning-home, rather than nuking all of Gatekeeper? (Some of its things like disallowing access to personal files by default are still nice to have) Will report back with an update after testing...
  - lunixbochs 6y ago
    I think tcc is separate from gatekeeper, so the granular permissions should still work.
- xenadu02 6y ago
  Adhoc code signatures just ensure the code pages are the same as they were when the binary was written without the system needing to jump through other hoops to fake up a different identity because the binary doesn't have one.
xenadu02 6y ago
First: binaries that ship with the system are not included in this because they're platform binaries. Tools like ps or grep won't be included. Second: once the binary has been checked for malware it won't be checked again. Third: if the connection fails immediately the malware check is skipped immediately. So if you are offline or otherwise force the relevant server DNS names to be rejected immediately it shouldn't wait for any timeout. Fourth: anything you build with the Xcode UI is automatically excluded since you are using the user interface and explicitly asking to run "unknown" code. Fifth: Anything listed as a Developer Tool in Privacy will have its child processes excluded from GateKeeper scanning. This command will make the category show up and put Terminal in it: "sudo spctl developer-mode enable-terminal" Once it shows up there go to Privacy and check the box to enable Terminal. If you run CI or automation you can do the same by putting your Jenkins or other binary in the list, causing all subprocesses to be excluded.
- luizfelberti 6y ago
  I was partly aware of many of these, and like I said I'm not 100% sure if this really is the culprit. Your comment is a solid reference on this topic though (better than most of what's on SO), but here's a few comments regarding my specific incident... On your first point: Was aware of this, and this is the part that is most puzzling about the whole incident to me. I just checked my $PATH and I am indeed running the system binaries, so not sure how to explain this one. On your second point: Was aware of this too, but I assume a lot of the slowness comes from JITted programs, for which there will be phoning-home for any new executable memory page (AFAIK), and the policy decision caching semantics for things that are not on disk are not as clear to me. On your third point: While this is true for the connection that gets established to Apple's servers, I think this might have had to do with DNS being UDP based by default (AFAIK), so there is no explicit refusal, and it hangs on a timeout because of that, even though DNS can be done over TCP as well. Haven't investigated this though, just a hunch... On your fourth and fifth points: I don't use XCode, but my terminal (Kitty) was already on the Developer Tool list when this happened, which makes the situation with ps and grep even more mysterious to me...
  - xenadu02 6y ago
_qulr 6y ago
> Does anyone have a tip to keep macOS from phoning home when you run unsigned binaries? Block the syspolicyd process with Little Snitch.
- _qulr 6y ago
  LOL I want to know who downvoted this.
  - xenadu02 6y ago
    No, my threshold for downvoting is quite high and I rarely do so.
gjvnq 6y ago
I think that the real question is: how to fool macOS into thinking all binaries are signed? In theory it should be possible to patch the function that checks for signatures, but I have no idea if anyone has actually tried it.

lunixbochs 6y ago

Edit: removed instructions to disable gatekeeper as sibling comment looks like a much better solution and writeup. I’m also curious if the self signed binaries in Big Sur fix this problem.

luizfelberti 6y ago
I'll test that out later today/tomorrow, thanks! I guess the questions I'd have regarding this that I'd need to validate would be: - Does this setting persist across reboots? - Does it stop phoning-home altogether, or will it still phone-home, but always authorize regardless of answer? - Is there a more granular way to disable just phoning-home, rather than nuking all of Gatekeeper? (Some of its things like disallowing access to personal files by default are still nice to have) Will report back with an update after testing...
- lunixbochs 6y ago
  I think tcc is separate from gatekeeper, so the granular permissions should still work.
xenadu02 6y ago
Adhoc code signatures just ensure the code pages are the same as they were when the binary was written without the system needing to jump through other hoops to fake up a different identity because the binary doesn't have one.

xenadu02 6y ago

First: binaries that ship with the system are not included in this because they're platform binaries. Tools like ps or grep won't be included. Second: once the binary has been checked for malware it won't be checked again. Third: if the connection fails immediately the malware check is skipped immediately. So if you are offline or otherwise force the relevant server DNS names to be rejected immediately it shouldn't wait for any timeout. Fourth: anything you build with the Xcode UI is automatically excluded since you are using the user interface and explicitly asking to run "unknown" code. Fifth: Anything listed as a Developer Tool in Privacy will have its child processes excluded from GateKeeper scanning. This command will make the category show up and put Terminal in it: "sudo spctl developer-mode enable-terminal" Once it shows up there go to Privacy and check the box to enable Terminal. If you run CI or automation you can do the same by putting your Jenkins or other binary in the list, causing all subprocesses to be excluded.

luizfelberti 6y ago
I was partly aware of many of these, and like I said I'm not 100% sure if this really is the culprit. Your comment is a solid reference on this topic though (better than most of what's on SO), but here's a few comments regarding my specific incident... On your first point: Was aware of this, and this is the part that is most puzzling about the whole incident to me. I just checked my $PATH and I am indeed running the system binaries, so not sure how to explain this one. On your second point: Was aware of this too, but I assume a lot of the slowness comes from JITted programs, for which there will be phoning-home for any new executable memory page (AFAIK), and the policy decision caching semantics for things that are not on disk are not as clear to me. On your third point: While this is true for the connection that gets established to Apple's servers, I think this might have had to do with DNS being UDP based by default (AFAIK), so there is no explicit refusal, and it hangs on a timeout because of that, even though DNS can be done over TCP as well. Haven't investigated this though, just a hunch... On your fourth and fifth points: I don't use XCode, but my terminal (Kitty) was already on the Developer Tool list when this happened, which makes the situation with ps and grep even more mysterious to me...
- xenadu02 6y ago

_qulr 6y ago

> Does anyone have a tip to keep macOS from phoning home when you run unsigned binaries? Block the syspolicyd process with Little Snitch.

_qulr 6y ago
LOL I want to know who downvoted this.
- xenadu02 6y ago
  No, my threshold for downvoting is quite high and I rarely do so.

gjvnq 6y ago

I think that the real question is: how to fool macOS into thinking all binaries are signed? In theory it should be possible to patch the function that checks for signatures, but I have no idea if anyone has actually tried it.