Hacker News Reader

Comment by smcleod | Hacker News Reader

Oh wow… please do not do that folks!

I disable SIP because I don't want to use an OS where I cannot debug programs which did not consent to be debugged. macOS makes it impossible to inspect failure states I encounter in normal usage (like I can on Linux with debuginfod enabled, or Windows with .pdb files) without first rebuilding the program in debug mode.

Surely you can do this with xattr?

I’ve never had problems debugging anything with SIP on.

My experience is that I was unable to debug Maestral (a Python program) crashing in native Cocoa bindings in LLDB, because the interpreter did not allow itself to be debugged. Mozilla says Firefox acts the same way at https://firefox-source-docs.mozilla.org/contributing/debuggi.... It's possible there's some workaround I'm not aware of, but I ended up disabling SIP just like every non-macOS computer I own.

Were you debugging a local install of python, or the default python installed as a part of the OS?

If the latter, it's definitely a footgun but you shouldn't be using it for applications. It's a legacy binary for scripts.

You can't debug system processes or anything with the hardened runtime enabled.

Sincerely, why is this your recommendation? What does this protect against and why do you consider it a concern?

Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Inte....

TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.

I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.

I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not

I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers.

Wouldn't it be far easier to enumerate what you want an app to access?

SIP means not messing with the system files, enumerated thusly: /System.

Enumerating what I do want an app to access is handled by Gatekeeper.

It's actually a larger list available in /System/Library/Sandbox/rootless.conf

> SIP means not messing with the system files, enumerated thusly: /System.

...and all its children, which is effectively the entire operating system

> Enumerating what I do want an app to access is handled by Gatekeeper.

Gatekeeper is not capable of this.

It's among the things Gatekeeper does, isn't it? As configured with PPPC?

Why would it be running with escalated privileges if you don't know what it is ?

I feel like you're assuming that applications have to be honest about what they are when they request a user-prompted permission. SIP makes that irrelevant.

No, I'm assuming that you know what you install and that apps run with the same rights your user has. Your user can't touch /System, so shouldn't the app

https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-...

It’s a core part of how macOS is prevents unauthorised modifications to the operating system and file system by malicious software.

Reply on news.ycombinator.com