5 ms·

Oh wow… please do not do that folks!

nyanpasu64 3y ago
I disable SIP because I don't want to use an OS where I cannot debug programs which did not consent to be debugged. macOS makes it impossible to inspect failure states I encounter in normal usage (like I can on Linux with debuginfod enabled, or Windows with .pdb files) without first rebuilding the program in debug mode.
- _joel 3y ago
  Surely you can do this with xattr?
- smcleod 3y ago
  I’ve never had problems debugging anything with SIP on.
  - deleted 3y ago
    [deleted]
  - nyanpasu64 3y ago
    My experience is that I was unable to debug Maestral (a Python program) crashing in native Cocoa bindings in LLDB, because the interpreter did not allow itself to be debugged. Mozilla says Firefox acts the same way at https://firefox-source-docs.mozilla.org/contributing/debugging/debugging_on_macos.html https://firefox-source-docs.mozilla.org/contributing/debuggi.... It's possible there's some workaround I'm not aware of, but I ended up disabling SIP just like every non-macOS computer I own.
    - duped 3y ago
      Were you debugging a local install of python, or the default python installed as a part of the OS? If the latter, it's definitely a footgun but you shouldn't be using it for applications. It's a legacy binary for scripts.
  - saagarjha 3y ago
    You can't debug system processes or anything with the hardened runtime enabled.
diogenes4 3y ago
Sincerely, why is this your recommendation? What does this protect against and why do you consider it a concern?
- cj 3y ago
  Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Integrity%20Protection%20is%20a,and%20folders%20on%20your%20Mac https://support.apple.com/en-us/102149#:~:text=System%20Inte.... TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.
  - diogenes4 3y ago
    I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.
    - digitalsushi 3y ago
      I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not
      - diogenes4 3y ago
        I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers. Wouldn't it be far easier to enumerate what you want an app to access?
        jmbwell 3y ago
        SIP means not messing with the system files, enumerated thusly: /System. Enumerating what I do want an app to access is handled by Gatekeeper.

I disable SIP because I don't want to use an OS where I cannot debug programs which did not consent to be debugged. macOS makes it impossible to inspect failure states I encounter in normal usage (like I can on Linux with debuginfod enabled, or Windows with .pdb files) without first rebuilding the program in debug mode.

_joel 3y ago
Surely you can do this with xattr?
smcleod 3y ago
I’ve never had problems debugging anything with SIP on.
- deleted 3y ago
  [deleted]
- nyanpasu64 3y ago
  My experience is that I was unable to debug Maestral (a Python program) crashing in native Cocoa bindings in LLDB, because the interpreter did not allow itself to be debugged. Mozilla says Firefox acts the same way at https://firefox-source-docs.mozilla.org/contributing/debugging/debugging_on_macos.html https://firefox-source-docs.mozilla.org/contributing/debuggi.... It's possible there's some workaround I'm not aware of, but I ended up disabling SIP just like every non-macOS computer I own.
  - duped 3y ago
    Were you debugging a local install of python, or the default python installed as a part of the OS? If the latter, it's definitely a footgun but you shouldn't be using it for applications. It's a legacy binary for scripts.
- saagarjha 3y ago
  You can't debug system processes or anything with the hardened runtime enabled.

diogenes4 3y ago

Sincerely, why is this your recommendation? What does this protect against and why do you consider it a concern?

cj 3y ago
Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Integrity%20Protection%20is%20a,and%20folders%20on%20your%20Mac https://support.apple.com/en-us/102149#:~:text=System%20Inte.... TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.
- diogenes4 3y ago
  I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.
  - digitalsushi 3y ago
    I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not
    - diogenes4 3y ago
      I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers. Wouldn't it be far easier to enumerate what you want an app to access?
      - jmbwell 3y ago
        SIP means not messing with the system files, enumerated thusly: /System. Enumerating what I do want an app to access is handled by Gatekeeper.