{"id":309,"date":"2015-11-01T23:40:28","date_gmt":"2015-11-01T23:40:28","guid":{"rendered":"http:\/\/tomas.papp.me.uk\/?p=309"},"modified":"2015-11-03T14:49:22","modified_gmt":"2015-11-03T14:49:22","slug":"strace-na-macos-sip","status":"publish","type":"post","link":"https:\/\/tomas.papp.me.uk\/?p=309","title":{"rendered":"“strace” na MacOS & SIP"},"content":{"rendered":"

..sa vola dtrace<\/p>\n

\/usr\/sbin\/dtrace a ma niekolko uskali<\/p>\n

1;) vyzaduje root-a, odporucam sudo dtrace sudo -u myuser traced_command<\/p>\n

2;) existuje nieco ako SIP<\/p>\n

As you may now Apple released their new OS X revision 10.11 this year with a great security feature built-in:\u00a0System Integrity Protection<\/a>. In a nutshell, this mechanism protects any system data and important filesystem components (like\u00a0\/System<\/code>\u00a0or\u00a0\/usr<\/code>) from being modified by user; even if they are\u00a0root<\/em>. SIP also disables any use of code-injection and debugging techniques for third-party software, so some of your favorite hacks may not work anymore. – ;))<\/p>\n

mile od Applu Anyway:<\/p>\n

Completely disable SIP<\/h3>\n

Although not recommended by Apple, you can entirely disable System Integrity Protection on you Mac. Here’s how:<\/p>\n

    \n
  1. Boot your Mac into Recovery Mode: reboot it and hold cmd+R until a progress bar appears.<\/li>\n
  2. Choose the language and go to Utilities menu. Choose Terminal there.<\/li>\n
  3. Enter this command to disable System Integrity Protection:\n
    \n
    $ csrutil<\/span> disable<\/code><\/pre>\n<\/div>\n<\/li>\n
  4. It will ask you to reboot \u2014 do so and you’re free from SIP!<\/li>\n<\/ol>\n
    The Good<\/h5>\n
    You’re able to do anything you want with the OS, yay! \u0669(\u2e1d\u2e1d\u2e1d\u25d5\u0e31 \u0bf0 \u25d5\u0e31\u2e1d\u2e1d\u2e1d )\u0648<\/p>\n
    The Bad<\/h5>\n
    You’re not safe<\/em>: there’re plenty of rootkits in a wild which can infect your system. Actually, you’re as safe as on OS X 10.10 or 10.9, so judge for yourself.<\/p>\n
    Partially disable SIP<\/h3>\n
    Fortunately, SIP is not monolithic: it’s built from many different modules we can disable\/enable separately. Let’s take a look at a typical\u00a0csrutil status<\/code>\u00a0output:<\/p>\n
    \n
    $ csrutil<\/span> status\r\nSystem<\/span> Integrity Protection status: enabled\r\n\r\nConfiguration<\/span>:\r\n    Apple<\/span> Internal: enabled\r\n    Kext<\/span> Signing: enabled\r\n    Filesystem<\/span> Protections: enabled\r\n    Debugging<\/span> Restrictions: enabled\r\n    DTrace<\/span> Restrictions: enabled\r\n    NVRAm<\/span> Protections: enabled<\/code><\/pre>\n<\/div>\n
    I can count 6 different subsystems out here. Here’s the way to selectively disable any of them:<\/p>\n
      \n
    1. Repeat steps 1 and 2 from \u00abCompletely disable SIP\u00bb section above.<\/li>\n
    2. Now in Terminal enter these commands:\n
      \n
      $ csrutil<\/span> clear # restore the default configuration first<\/span>\r\n$ csrutil<\/span> enable --without dtrace # disable dtrace restrictions *only*<\/span><\/code><\/pre>\n<\/div>\n
      That’s it: use\u00a0csrutil enable<\/code>\u00a0+\u00a0--without<\/code>\u00a0flag with a name of a module you want to disable:<\/p>\n
      \n
      $ csrutil<\/span> enable --without kext\r\n$ csrutil<\/span> enable --without fs\r\n$ csrutil<\/span> enable --without debug\r\n$ csrutil<\/span> enable --without dtrace\r\n$ csrutil<\/span> enable --without nvram\r\n# this one below is different, not sure why. Don't encourage you to disable it anyways\u2026<\/span>\r\n$ csrutil<\/span> enable --no-internal<\/code><\/pre>\n<\/div>\n<\/li>\n
    3. Reboot and enjoy your OS again.<\/li>\n<\/ol>\n
      The Good<\/h5>\n
      If you only disable\u00a0dtace<\/code>\u00a0module you’re still quite safe: SIP will keep an eye on your filesystem and kernel extensions as well as on any software trying to inject code.<\/p>\n
      The Bad<\/h5>\n
      You’re\u00a0still unable<\/em>\u00a0to attach dtrace to restricted processes<\/p>\n
      \n
      $ sudo<\/span> dtruss echo \"demo\"<\/span> dtrace<\/span>: failed to execute echo: dtrace cannot control executables signed with restricted entitlements <\/code><\/p>\n
      <\/code><\/div>\n
      <\/div>\n
      alebo spusti vo virtualke <\/code><\/p>\n
      ( http:\/\/internals.exposed\/blog\/dtrace-vs-sip.html )<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
      ..sa vola dtrace \/usr\/sbin\/dtrace a ma niekolko uskali 1;) vyzaduje root-a, odporucam sudo dtrace sudo -u myuser traced_command 2;) existuje nieco ako SIP As you may now Apple released their new OS X revision 10.11 this year with a great security feature built-in:\u00a0System Integrity Protection. In a nutshell, this mechanism protects any system data and […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-309","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/posts\/309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=309"}],"version-history":[{"count":4,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions"}],"predecessor-version":[{"id":313,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions\/313"}],"wp:attachment":[{"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tomas.papp.me.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}