24 ms·
https://github.com/macOScontainers/homebrew-formula https://github.com/macOScontainers/homebrew-formula "macOS native containers" Cool, this sounds interestin
by highwaylights 3y ago
https://github.com/macOScontainers/homebrew-formula https://github.com/macOScontainers/homebrew-formula
"macOS native containers"
Cool, this sounds interesting.
"Disable System Identity Protection."
Eesh.
- dddnzzz334 3y ago[flagged]
- highwaylights 3y agoI opt-in to a prison with trade-offs I deem reasonable for what I get out of it. I have a couple of Linux devices too. Being interested in this project and simultaneously disappointed it requires SIP to be disabled are not conflicting views, even if a little unfortunate for me personally.
- cassianoleal 3y agoYou're free to disable SIP, so your post makes no sense. It's more akin to locking your front door. Keep it locked if you want the extra protection but feel free to crank the door open if you want the breeze to come in, but knowing that more than the breeze might do so.
- lopkeny12ko 3y agoHave you ever tried modifying the filesystem a couple levels under /? Last I used a Mac I remember trying to create a new directory in / and writing to /bin (or something like that). I was appalled that Mac doesn't let you do anything other than read-only operations for select paths a few levels under root, and as I remember, there way no way to disable this asinine behavior.
- doctor_eval 3y agoI say this as someone who has used Unix, MacOS and Linux for most of his long life: not being able to write to /bin and other system directories is a feature and I really don’t understand how anybody in 2023 could see it otherwise. Freedom does not just imply the ability to do the things you want, but also the ability to avoid the things you don’t.
- pasc1878 3y agoWhy 2023 writing to /bin was always a bad idea in 1994 when I first used Unix and would have been so even earlier.
- slonopotamus 3y agoYou can just mount it readonly.
- pasc1878 3y agoYes which as I have said done since the early 1990s
- deleted 3y ago[deleted]
- cassianoleal 3y agolol what? What's the point of this exercise? Is this some kind of power play against the... operating system?! Did this prevent you from achieving anything? In any case, I'm fairly confident if you disable SIP and do a couple extra steps, you can get write access to those.
- prmoustache 3y agoOTOH it is the same for an "immutable" linux distro.
- iFreilicht 3y agoThat specific example doesn't seem to be an issue anymore. The Nix Installer creates /nix/store on macOS 13.5 just fine without disabling SIP. You do need admin rights of course.
- irjustin 3y agoFWIW, i like the security without thinking. Yes, I give up freedoms but I gain a lot in lack of cognitive load.
- deleted 3y ago[deleted]
- pjmlp 3y agoPeople are free to buy the hardware they feel like. Given the numbers of UNIX devs that rather use macOS than either pure BSD or GNU/Linux, that prison is quite comfy.
- k4rli 3y agoSeems like all counterarguments to this fact sound like people who aren't competent enough and/or don't understand the basics. There doesn't need to be a higher cognitive load using Linux and security arguments make even less sense.
- timeon 3y ago> You live in a prison. It is just computer.
- jamil7 3y agoIt's a prison if you base your whole personality on your choice of hardware and operating system.
- perryizgr8 3y ago> "Disable System Identity Protection." This is the first thing I do on any Mac OS system before I start using it.
- przems 3y agoCould you elaborate why? I’m new to macOS, I’d love to learn more about it.
- sacnoradhq 3y agoDon't disable security features because of random comments from randos. Also, don't install shit anywhere but your home directory as you unless you want to break your system in an irreparably, unmaintainable, or unsupported manner. If you're using sudo, you're already doing it wrong. https://support.apple.com/en-us/102149 https://support.apple.com/en-us/102149
- avidphantasm 3y agoCivilized people don’t install things in “/“.
- dkonofalski 3y agoI'm not sure if you were arguing against the parent comment or supporting it but did you actually mean "/" and not "~/"?
- fredoliveira 3y agoReads like support, and I'm 99% sure they mean "/"
- Wowfunhappy 3y ago> Also, don't install shit anywhere but your home directory as you unless you want to break your system in an irreparably, unmaintainable, or unsupported manner. I guess you don't use Homebrew or MacPorts?
- maggit 3y ago"System Integrity Protection (SIP)" seems to be the correct name here, for anyone as confused as me :) (More details here: https://support.apple.com/en-us/102149 https://support.apple.com/en-us/102149 )
- slonopotamus 3y agoOriginal author here. Thanks for spotting the typo, fixed. WRT security implications of disabling SIP - I don't think OS becomes any less vulnerable than usual Linux/Windows installation.
- mbreese 3y agoAnd that’s a good thing? I’m not sure the benefits of containers would be worth disabling SIP. Maybe for an automated test CI/CD running system (which is probably the main use-case), but not on anything that users would interact with.
- slonopotamus 3y ago> And that’s a good thing? That's a technical limitation.
- mbreese 3y agoTechnical limitations aren’t excuses for a bad design. If it’s not a good design due to a technical limit, the answer isn’t to sacrifice security for functionality. If it really isn’t technically possible (which I think you might be able to do in a Darwin VM), then maybe this approach isn’t a good idea.
- slonopotamus 3y ago> Technical limitations aren’t excuses for a bad design. Tomorrow Apple might decide it is safe to chroot with SIP enabled (I actually do not understand why they restrict it, chroot is a tool to increase security). Does that suddenly convert bad design into a good design? But this is exactly the same design.
- solatic 3y agoI'm more interested in this as part of a CI/CD process for releasing macOS software. For an isolated build worker - yeah, sure, I'll go ahead and disable SIP. Not every workload is running on an endpoint connected to a human via keyboard and screen.
- garblegarble 3y ago>For an isolated build worker - yeah, sure, I'll go ahead and disable SIP. Isn't this especially dangerous on a build worker? All your source code goes in and you (presumably) use the binaries that come out across the rest of your infrastructure. Compromising a build worker in a persistent fashion due to lack of SIP seems like it could do some serious[1] harm... 1: https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- solatic 3y agoDepends on your threat modeling. Are you running untrusted code on the worker (maybe you have an org with thousands of engineers, maybe you're running builds from a public fork)? Sure, that's an issue. Are you a small startup? Take the convenience and focus on the bigger fish to fry.
- sacnoradhq 3y ago> Disable System Identity [sic] Protection. Aaand, it's stillborn. Not happening.
- jamil7 3y agoIn the context of an internal CI or something, it's probably fine.
- steeleduncan 3y agoGiven that the vast majority of CI runs on linux without any equivalent of SIP, I'd have thought it were a complete non-issue
- tiagod 3y agoYou might want to run CI/CD on your Mac builds
- nsonha 3y agoWouldn't recommend this to people prone to identity crises
- deleted 3y ago[deleted]
- smcleod 3y agoOh wow… please do not do that folks!
- nyanpasu64 3y agoI disable SIP because I don't want to use an OS where I cannot debug programs which did not consent to be debugged. macOS makes it impossible to inspect failure states I encounter in normal usage (like I can on Linux with debuginfod enabled, or Windows with .pdb files) without first rebuilding the program in debug mode.
- _joel 3y agoSurely you can do this with xattr?
- smcleod 3y agoI’ve never had problems debugging anything with SIP on.
- deleted 3y ago[deleted]
- nyanpasu64 3y agoMy experience is that I was unable to debug Maestral (a Python program) crashing in native Cocoa bindings in LLDB, because the interpreter did not allow itself to be debugged. Mozilla says Firefox acts the same way at https://firefox-source-docs.mozilla.org/contributing/debugging/debugging_on_macos.html https://firefox-source-docs.mozilla.org/contributing/debuggi.... It's possible there's some workaround I'm not aware of, but I ended up disabling SIP just like every non-macOS computer I own.
- duped 3y agoWere you debugging a local install of python, or the default python installed as a part of the OS? If the latter, it's definitely a footgun but you shouldn't be using it for applications. It's a legacy binary for scripts.
- comandillos 3y agoThat's what it takes to implement container-ish technology on macOS. Hopefully one day Darwin will get real namespaces as Linux does.
- conradev 3y agoOrbStack doesn’t require breaking security: https://orbstack.dev/ https://orbstack.dev/
- dkonofalski 3y agoDoes OrbStack allow you to create MacOS Containers? It doesn't seem like it from their website. It seems like it just runs on MacOS to let you create Linux containers.
- slonopotamus 3y agoOrbStack is about Linux containers. What we're talking about in this topic is the only software in the world for macOS containers.
- dkonofalski 3y agoThen I wonder why the parent comment mentioned OrbStack as if it were somehow comparable or an alternative to this.
- satvikpendem 3y agoI always disable SIP on every Mac I own. It's not very useful and I can run whatever I want on my hardware.
- zshrc 3y agoI hope that's sarcasm. https://support.apple.com/en-us/102149 https://support.apple.com/en-us/102149 https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web https://support.apple.com/guide/security/system-integrity-pr...
- satvikpendem 3y agoWhy would it be sarcasm? If I am root and want to write to /bin or /System, I should be able to, even if it might be dangerous. I get why Apple does it for normal consumers but for people who know what they're doing, it should be available, which it is by disabling it.
- rakoo 3y ago"v0.0.1" There's probably a hundred things that are not right just yet and they know it, let's not be overly negative (although the discussion on what it is and what it does definitely is interesting)
- nunez 3y agoI'm sure they'll overcome this! Rootless containers are a thing after all!