5 ms·

Then it's not root...

anyfoo 4y ago
root is essentially a POSIX concept, and from a POSIX perspective this is still root, it’s just that the POSIX security model is by far not the only thing in play here.
- NobodyNada 4y ago
  When Apple introduced SIP, they marketed it as “Rootless”.
waynecochran 4y ago
OK ... so w MacOS there is a user w more power than root? There has to be some entity that can ultimately install a new kernel and subsystem.
- anyfoo 4y ago
  It’s more that there is far more protecting the system (and also e.g. data from different apps against each other, or things like access to your screen content), than the current user. Some of this is because we’re in a world where Macs and iPhones are far more likely to be single user machines than the UNIX machines of lore. See the PDF in my other answer.
- AgentME 4y ago
  There could be code in the system that directs IO and only allows write requests to parts of the OS if they include a signature from Apple. I'm not sure if "a user with more power than root" would be the right way to describe that. The code would have a permission that "root" doesn't, but I wouldn't call the code "a user". It's a Unix idea that "a specific set of permissions" and "a user" are synonyms. Systems can exist where some permissions aren't represented as users.
- olliej 4y ago
  No, there is no more powerful user, it’s just that the root user no longer has arbitrary control - it means that if an attacker compromises a root owned process the attacker can’t turn around and control the kernel. The kernel has a number of things it can do: if you try to do a special thing it could force authentication itself - eg a “root”/admin user can still do the action, but a process with “root privileges” cannot, it can require the process attempting the action have correct entitlements, it can simply reject the operation entirely, etc. it can do all of the above: I recall there being some operations that can only be performed by specific apps, with specific entitlements, as special users, with immediate authentication (startup items and the like)
varenc 4y ago
SIP is another system that exists besides POSIX and the root user. With SIP enabled, let me demonstrate: chris@chriscomp /usr/bin # sudo su root root@chriscomp /usr/bin # touch testo touch: testo: Operation not permitted The possibility of privilege escalation vulns, like this one, exactly demonstrates the value of SIP! If someone escalates to root they can still do a lot of damage, but they can't do things like install a deep rootkit/kernel extension to silently snoop on you forever. SIP also protects other things like your apple messages DB located at `~/Library/Messages/chat.db` . Even the root user, if running from a non-privileged origin process, can't read that file: root@chriscomp / # cat /Users/chris/Library/Messages/chat.db cat: /Users/chris/Library/Messages/chat.db: Operation not permitted Granting an application/terminal the special Developer permission allows reading it though.

root is essentially a POSIX concept, and from a POSIX perspective this is still root, it’s just that the POSIX security model is by far not the only thing in play here.

NobodyNada 4y ago
When Apple introduced SIP, they marketed it as “Rootless”.

waynecochran 4y ago

OK ... so w MacOS there is a user w more power than root? There has to be some entity that can ultimately install a new kernel and subsystem.

anyfoo 4y ago
It’s more that there is far more protecting the system (and also e.g. data from different apps against each other, or things like access to your screen content), than the current user. Some of this is because we’re in a world where Macs and iPhones are far more likely to be single user machines than the UNIX machines of lore. See the PDF in my other answer.
AgentME 4y ago
There could be code in the system that directs IO and only allows write requests to parts of the OS if they include a signature from Apple. I'm not sure if "a user with more power than root" would be the right way to describe that. The code would have a permission that "root" doesn't, but I wouldn't call the code "a user". It's a Unix idea that "a specific set of permissions" and "a user" are synonyms. Systems can exist where some permissions aren't represented as users.
olliej 4y ago
No, there is no more powerful user, it’s just that the root user no longer has arbitrary control - it means that if an attacker compromises a root owned process the attacker can’t turn around and control the kernel. The kernel has a number of things it can do: if you try to do a special thing it could force authentication itself - eg a “root”/admin user can still do the action, but a process with “root privileges” cannot, it can require the process attempting the action have correct entitlements, it can simply reject the operation entirely, etc. it can do all of the above: I recall there being some operations that can only be performed by specific apps, with specific entitlements, as special users, with immediate authentication (startup items and the like)

varenc 4y ago

SIP is another system that exists besides POSIX and the root user. With SIP enabled, let me demonstrate: chris@chriscomp /usr/bin # sudo su root root@chriscomp /usr/bin # touch testo touch: testo: Operation not permitted The possibility of privilege escalation vulns, like this one, exactly demonstrates the value of SIP! If someone escalates to root they can still do a lot of damage, but they can't do things like install a deep rootkit/kernel extension to silently snoop on you forever. SIP also protects other things like your apple messages DB located at `~/Library/Messages/chat.db` . Even the root user, if running from a non-privileged origin process, can't read that file: root@chriscomp / # cat /Users/chris/Library/Messages/chat.db cat: /Users/chris/Library/Messages/chat.db: Operation not permitted Granting an application/terminal the special Developer permission allows reading it though.