3 ms·

IIUC, safari and other essential OS components are mounted on a read-only volume. The installer has to perform special shenanigans to update it.

by xrisk 3y ago

flangola7 3y ago
> IIUC, safari and other essential OS components are mounted on a read-only volume I... what?
- deleted 3y ago
  [deleted]
- pcl 3y ago
  If I Understand Correctly
- olliej 3y ago
  As a basic security measure the macOS system partition is readonly and cryptographically signed. https://support.apple.com/guide/security/signed-system-volume-security-secd698747c9/1/web/1 https://support.apple.com/guide/security/signed-system-volum...
  - lern_too_spel 3y ago
    Many other systems, including ostree and Android, have solved this problem years ago. For example, the update can be installed on a read-only cryptographically signed overlay.
- zamnos 3y ago
  That's right. Safari is an application and so lives under /Applications, which is one a few special directories where the user can make changes, which actually live under /System/Volumes/Data in a scheme similar to unionfs under Linux. Which is to say, / under Catalina and above (so, since 2019), the root partition is really the mount of an APFS snapshot. There's security as a reason, but also from a system perspective, it makes it more robust to upgrade/downgrade OS versions under such a scheme because you always have a known-good system image to revert back to. Safari though is a special case, and so /Applications/Safari.app is a symlink to ../System/Cryptexes/App/System/Applications/Safari.app https://superuser.com/questions/1495124/read-only-file-system-when-i-try-to-touch-in-mac-os-catalina https://superuser.com/questions/1495124/read-only-file-syste...
  - olliej 3y ago
    More importantly, it's updating the system WebKit framework, which is a core framework so even if Safari.app was separate, the system framework update forces the reboot. The Safari Technical Previews include their own complete copy of the WebKit framework and link to that (and Safari.app can be made to load WebKit.framework from elsewhere which is how webkit nightlies and from-source builds of webkit can be used)
Operyl 3y ago
Yup, see page 51: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec...
r00fus 3y ago
Good defense in depth. Frustrating this requires an OS update & reboot, but I prefer that to weakening the defense model.
pritambaral 3y ago
A read-only mount doesn't require the backing store to be immutable, nor does it need open fds on the mount to be closed for the backing store to be updated. I've shipped embedded devices that had read-only rootfs mounts and the updater didn't need to reboot before (or after) applying updates. Of course, this was on the Linux kernel, which does support replacing open files. EDIT: I feel obligated to say this: pitchforks down, please. I'm not trying to disparage the macOS kernel. As a designer of software systems interested in how OSes are built, I found the choices taken interesting.

IIUC, safari and other essential OS components are mounted on a read-only volume. The installer has to perform special shenanigans to update it.

by xrisk 3y ago

IIUC, safari and other essential OS components are mounted on a read-only volume. The installer has to perform special shenanigans to update it.

flangola7 3y ago

> IIUC, safari and other essential OS components are mounted on a read-only volume I... what?

deleted 3y ago
[deleted]
pcl 3y ago
If I Understand Correctly
olliej 3y ago
As a basic security measure the macOS system partition is readonly and cryptographically signed. https://support.apple.com/guide/security/signed-system-volume-security-secd698747c9/1/web/1 https://support.apple.com/guide/security/signed-system-volum...
- lern_too_spel 3y ago
  Many other systems, including ostree and Android, have solved this problem years ago. For example, the update can be installed on a read-only cryptographically signed overlay.
zamnos 3y ago
That's right. Safari is an application and so lives under /Applications, which is one a few special directories where the user can make changes, which actually live under /System/Volumes/Data in a scheme similar to unionfs under Linux. Which is to say, / under Catalina and above (so, since 2019), the root partition is really the mount of an APFS snapshot. There's security as a reason, but also from a system perspective, it makes it more robust to upgrade/downgrade OS versions under such a scheme because you always have a known-good system image to revert back to. Safari though is a special case, and so /Applications/Safari.app is a symlink to ../System/Cryptexes/App/System/Applications/Safari.app https://superuser.com/questions/1495124/read-only-file-system-when-i-try-to-touch-in-mac-os-catalina https://superuser.com/questions/1495124/read-only-file-syste...
- olliej 3y ago
  More importantly, it's updating the system WebKit framework, which is a core framework so even if Safari.app was separate, the system framework update forces the reboot. The Safari Technical Previews include their own complete copy of the WebKit framework and link to that (and Safari.app can be made to load WebKit.framework from elsewhere which is how webkit nightlies and from-source builds of webkit can be used)

Operyl 3y ago

Yup, see page 51: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec...

r00fus 3y ago

Good defense in depth. Frustrating this requires an OS update & reboot, but I prefer that to weakening the defense model.

pritambaral 3y ago

A read-only mount doesn't require the backing store to be immutable, nor does it need open fds on the mount to be closed for the backing store to be updated. I've shipped embedded devices that had read-only rootfs mounts and the updater didn't need to reboot before (or after) applying updates. Of course, this was on the Linux kernel, which does support replacing open files. EDIT: I feel obligated to say this: pitchforks down, please. I'm not trying to disparage the macOS kernel. As a designer of software systems interested in how OSes are built, I found the choices taken interesting.