4 ms·

You cannot do these with all security enabled, no. There are lots of other things that are prevented by SIP and/or Secure Boot. One of the principles is that be

by anyfoo 4y ago

You cannot do these with all security enabled, no. There are lots of other things that are prevented by SIP and/or Secure Boot. One of the principles is that being root should not mean that the kernel can be readily attacked without further bugs. That also means no /dev/kmem etc., and on top of that POSIX file permissions are by far not the only thing that is protecting access to the file system. If you want to go down the rabbit hole: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec...

waynecochran 4y ago
That is a deep hole. I see there is a chain of certificates of trust for fine grain control to all the system parts beginning with the boot sequence. A lot more complicated than Unix systems of yore.
- counttheforks 4y ago
  Apple goes through a lot of effort to keep control of the system out of their customer's hands.
  - acdha 4y ago
    It's a delicate balance because Apple has to support a lot of people and at this point there are literally decades of experience showing that many people, including administrators and developers, will make mistakes or bad decisions due to social engineering or simply greed (how many people installed malware because they thought it was cheaper than paying $20 for a software license?). SIP is a good compromise: it prevents malware from gaining completely control of the system but someone with physical access and administrator privileges can disable it for the few situations where that's desirable. That's not a high bar when you need it but it probably has a 100000:1 ratio of time preventing someone's day from getting worse to actually preventing legitimate work.
  - dvzk 4y ago
    Linux and the BSDs really should have a more restricted default desktop capability model compared to macOS by now. It's a shame that Qubes is the main response we have, not because it's bad, but because it's almost necessary.
  - astrange 4y ago
    You shouldn’t run a web browser on any system with less security than this. (It doesn’t have nearly enough security yet, but it’s much more advanced than Linux. And strangely also OpenBSD, who like defending against imaginary attackers doing imaginary attacks instead of their real weak points.)
  - dagmx 4y ago
    SIP really helps protect people from themselves, and it’s easily disabled for those who need it (but it’s definitely a red flag). A couple years ago many edit houses in LA suddenly had boot issues because a Chrome update was over writing system files when the updater was run with elevated privileges. The issue was that these studios used Avid which required disabling sip at the time. Other houses that didn’t disable sip were unaffected because it protects against exactly this kind of scenario.
    - GekkePrutser 4y ago
      I don't want to be protected from myself. As the admin I should have full access to the stuff I buy. Disabling it is ok but the problem with that is that you lose all security. There should be a way to add our own signing keys to persist changes to the SSV (Signed System Volume) and SIP protected folders. It shouldn't be trust only Apple or nothing.
      - dagmx 4y ago
        You do have full access to what you buy. While it would be nice to both have full access AND the security, that’s still not denying you full access.
      - pjmlp 4y ago
        This is not for you, rather for the kind of people that get Ask Jeeves installed when clicking on popups while browsing the Web.
        counttheforks 4y ago
        They shouldn't have the same rights? Just because someone is less technologically aware today, you think it's OK to start stripping away their rights? That's like saying poor people shouldn't be allowed to own a house because they won't be able to afford the maintenance.
        dagmx 4y ago
- sydney6 4y ago
  securelevel [1] is a similar feature from/for FreeBSD. As an example, it could be used to build e.g. a true append-only syslog server which even root would not be able to manipulate the data without a reboot or, in combination with other techniques like a capiscum-sandboxed tcpdump implementation, highly secure network appliance.. plenty of use-cases. [1] https://www.freebsd.org/cgi/man.cgi?query=securelevel&apropos=0&sektion=0&manpath=FreeBSD+6.2-RELEASE&format=html https://www.freebsd.org/cgi/man.cgi?query=securelevel&apropo...

by anyfoo 4y ago

waynecochran 4y ago

That is a deep hole. I see there is a chain of certificates of trust for fine grain control to all the system parts beginning with the boot sequence. A lot more complicated than Unix systems of yore.

counttheforks 4y ago
Apple goes through a lot of effort to keep control of the system out of their customer's hands.
- acdha 4y ago
  It's a delicate balance because Apple has to support a lot of people and at this point there are literally decades of experience showing that many people, including administrators and developers, will make mistakes or bad decisions due to social engineering or simply greed (how many people installed malware because they thought it was cheaper than paying $20 for a software license?). SIP is a good compromise: it prevents malware from gaining completely control of the system but someone with physical access and administrator privileges can disable it for the few situations where that's desirable. That's not a high bar when you need it but it probably has a 100000:1 ratio of time preventing someone's day from getting worse to actually preventing legitimate work.
- dvzk 4y ago
  Linux and the BSDs really should have a more restricted default desktop capability model compared to macOS by now. It's a shame that Qubes is the main response we have, not because it's bad, but because it's almost necessary.
- astrange 4y ago
  You shouldn’t run a web browser on any system with less security than this. (It doesn’t have nearly enough security yet, but it’s much more advanced than Linux. And strangely also OpenBSD, who like defending against imaginary attackers doing imaginary attacks instead of their real weak points.)
- dagmx 4y ago
  SIP really helps protect people from themselves, and it’s easily disabled for those who need it (but it’s definitely a red flag). A couple years ago many edit houses in LA suddenly had boot issues because a Chrome update was over writing system files when the updater was run with elevated privileges. The issue was that these studios used Avid which required disabling sip at the time. Other houses that didn’t disable sip were unaffected because it protects against exactly this kind of scenario.
  - GekkePrutser 4y ago
    I don't want to be protected from myself. As the admin I should have full access to the stuff I buy. Disabling it is ok but the problem with that is that you lose all security. There should be a way to add our own signing keys to persist changes to the SSV (Signed System Volume) and SIP protected folders. It shouldn't be trust only Apple or nothing.
    - dagmx 4y ago
      You do have full access to what you buy. While it would be nice to both have full access AND the security, that’s still not denying you full access.
    - pjmlp 4y ago
      This is not for you, rather for the kind of people that get Ask Jeeves installed when clicking on popups while browsing the Web.
      - counttheforks 4y ago
        They shouldn't have the same rights? Just because someone is less technologically aware today, you think it's OK to start stripping away their rights? That's like saying poor people shouldn't be allowed to own a house because they won't be able to afford the maintenance.
        dagmx 4y ago
sydney6 4y ago
securelevel [1] is a similar feature from/for FreeBSD. As an example, it could be used to build e.g. a true append-only syslog server which even root would not be able to manipulate the data without a reboot or, in combination with other techniques like a capiscum-sandboxed tcpdump implementation, highly secure network appliance.. plenty of use-cases. [1] https://www.freebsd.org/cgi/man.cgi?query=securelevel&apropos=0&sektion=0&manpath=FreeBSD+6.2-RELEASE&format=html https://www.freebsd.org/cgi/man.cgi?query=securelevel&apropo...