5 ms·

So reboot your machine and disable it if you want. Aren't you able to do that for some reason?

by anu_gupta 10y ago

chris_wot 10y ago
Not if I want to update system software for some reason and I'm running a server.
- anu_gupta 10y ago
  So you install development tools like XCode on a server?
  - chris_wot 10y ago
    Some folks install git on the server, sure. Do you know every single use case of every single server?
    - anu_gupta 10y ago
      I'm talking about how you got this version of git on this server. A server that's so mission critical that you're not allowed to reboot it. Why would you install Xcode on such a important box?
      - chris_wot 10y ago
        You are missing the wider point I fear. You seem to be so focused on git that you miss the point that there are other system utilities that are installed in /usr that you might need to patch. And if I want to troubleshoot something odd, it would be nice to be able to hook in dtrace - without rebooting the server, flipping a switch to disable the "feature", and then troubleshoot my server's issue.
        anu_gupta 10y ago
        No, I'm just bored of faux-outrage and agenda pushing. If this is such a critical issue, then reboot your Mac and disable SIP. 5 minutes and done. In the time it's taken you to post all your comments here, you could have fixed it. [edited to add] It's not like SIP was a secret - it was one of the major features of El Capitan. Didn't you do any research before upgrading your mission critical server to El Capitan?
        chris_wot 10y ago
        You read into what is not there. I know about SIP already, but I've always been surprised about it as it seems pretty flawed to me - it turns out if you can get root access you can easily bypass the "protection" mechanism with a small utility that loads up a kernel extension and bypasses the mechanism anyway. https://github.com/gdbinit/rootfool https://github.com/gdbinit/rootfool Incidentally, calm down a bit - you sound pretty outraged yourself! You might want to address the dtrace issue though - let's say you didn't want to disable the protection that SIP provides in making the /usr filesystem immutable. How do you then run dtrace on system utilities when troubleshooting? Genuinely curious how you answer that. Edit to ask another question: another question for you, as you seem to have the answers here: why does Apple install git in a directory that is under the control of System Integrity Protection? Why not under /usr/local? It's not exactly a "system utility" - it's a DVCS and not in any way critical to the running of the system. Hell, I'd not even consider it system software. And how does Apple do this? The last time I installed the XCode command line tools, I don't recall that I had to reboot my system, so it looks like Apple do indeed have an update mechanism to overwrite the files. In which case it is one exploit away from disabling the file immutability protections afforded by SIP...
        lmm 10y ago
        > Edit to ask another question: another question for you, as you seem to have the answers here: why does Apple install git in a directory that is under the control of System Integrity Protection? Why not under /usr/local? It's not exactly a "system utility" - it's a DVCS and not in any way critical to the running of the system. Hell, I'd not even consider it system software. I can imagine git might be necessary for applying some updates (on FreeBSD svn is a critical part of the base system, because one way to update is by svn updating the source and rebuilding).
  - Manishearth 10y ago
    We use a mac server as a build machine. It's pretty annoying; given that you need to graphically log in to accept a license every now and then to use lldb (a non-graphical debugger) among other things. In our case I think rebooting the server works, but you can't be aware of all usecases.
    - acdha 10y ago
      Try: sudo xcodebuild -license
      - Manishearth 10y ago
        Ooh, thanks!
        acdha 10y ago
        Just on the off-chance you haven't already seen it, the install trigger for the command-line toolchain is: sudo xcode-select --install

So reboot your machine and disable it if you want. Aren't you able to do that for some reason?

chris_wot 10y ago

Not if I want to update system software for some reason and I'm running a server.

anu_gupta 10y ago
So you install development tools like XCode on a server?
- chris_wot 10y ago
  Some folks install git on the server, sure. Do you know every single use case of every single server?
  - anu_gupta 10y ago
    I'm talking about how you got this version of git on this server. A server that's so mission critical that you're not allowed to reboot it. Why would you install Xcode on such a important box?
    - chris_wot 10y ago
      You are missing the wider point I fear. You seem to be so focused on git that you miss the point that there are other system utilities that are installed in /usr that you might need to patch. And if I want to troubleshoot something odd, it would be nice to be able to hook in dtrace - without rebooting the server, flipping a switch to disable the "feature", and then troubleshoot my server's issue.
      - anu_gupta 10y ago
        No, I'm just bored of faux-outrage and agenda pushing. If this is such a critical issue, then reboot your Mac and disable SIP. 5 minutes and done. In the time it's taken you to post all your comments here, you could have fixed it. [edited to add] It's not like SIP was a secret - it was one of the major features of El Capitan. Didn't you do any research before upgrading your mission critical server to El Capitan?
        chris_wot 10y ago
        You read into what is not there. I know about SIP already, but I've always been surprised about it as it seems pretty flawed to me - it turns out if you can get root access you can easily bypass the "protection" mechanism with a small utility that loads up a kernel extension and bypasses the mechanism anyway. https://github.com/gdbinit/rootfool https://github.com/gdbinit/rootfool Incidentally, calm down a bit - you sound pretty outraged yourself! You might want to address the dtrace issue though - let's say you didn't want to disable the protection that SIP provides in making the /usr filesystem immutable. How do you then run dtrace on system utilities when troubleshooting? Genuinely curious how you answer that. Edit to ask another question: another question for you, as you seem to have the answers here: why does Apple install git in a directory that is under the control of System Integrity Protection? Why not under /usr/local? It's not exactly a "system utility" - it's a DVCS and not in any way critical to the running of the system. Hell, I'd not even consider it system software. And how does Apple do this? The last time I installed the XCode command line tools, I don't recall that I had to reboot my system, so it looks like Apple do indeed have an update mechanism to overwrite the files. In which case it is one exploit away from disabling the file immutability protections afforded by SIP...
        lmm 10y ago
        > Edit to ask another question: another question for you, as you seem to have the answers here: why does Apple install git in a directory that is under the control of System Integrity Protection? Why not under /usr/local? It's not exactly a "system utility" - it's a DVCS and not in any way critical to the running of the system. Hell, I'd not even consider it system software. I can imagine git might be necessary for applying some updates (on FreeBSD svn is a critical part of the base system, because one way to update is by svn updating the source and rebuilding).
- Manishearth 10y ago
  We use a mac server as a build machine. It's pretty annoying; given that you need to graphically log in to accept a license every now and then to use lldb (a non-graphical debugger) among other things. In our case I think rebooting the server works, but you can't be aware of all usecases.
  - acdha 10y ago
    Try: sudo xcodebuild -license
    - Manishearth 10y ago
      Ooh, thanks!
      - acdha 10y ago
        Just on the off-chance you haven't already seen it, the install trigger for the command-line toolchain is: sudo xcode-select --install