Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have been reading the OSX security pdf from the apple site, it describes how to ensure Snow Leopard can be brought up to the Common Compliance standard.

Entirely different than the diffident documentation available from the "help" system.

I love it. What I don't love however, is the degree to which I had become complacent, treating the laptop as a secured place with a great UI to do my work. I found out today, for example, that Spotlight seems to not index /System, which is lunacy, that is the most important place to keep an eye on files!

Where is detailed documentation like this pdf available for the core system?

EDIT: Am I asking on the wrong site of the increasingly fragmented stack empire? There is no tag for 'documentation', or 'howto'?

EDIT: Found them. Developer tools,

com.apple.adc.documentation.AppleSnowLeopard.CoreReference.docset

That's the goodstuff. How to master the system, not just play with it.

share|improve this question
    
Regarding the tag question: tags (like 'documentation' in this case) don't exist before they are used for the first time. Anyone with >= 150 rep can create new tags (you have 151 now, so you probably couldn't when you asked this). I tagged this 'documentation' so now that tag exists. –  Jonik Nov 16 '10 at 9:11
    
@Jonik, Thanks! Rereading this question I should apologize for my lack of clarity: The security pdf is comprehensive. That's what I liked about it, and that's what I meant about good docs: The reading of such should impart practical understanding. Many times closed source docs seem a bit vague, Apple's particularly so. This whole discussion, although very valuable, is due to my imprecision. Sorry about that. –  chiggsy Nov 17 '10 at 1:37
add comment

1 Answer

up vote 5 down vote accepted

I believe that you’re not asking in the wrong place, you’re really not asking a question. What you define like “The Good Docs” is completely subjective. The guide you linked clearly says:

Important: This document is intended for use by security professionals in sensitive environments. Implementing the techniques and settings found in this document impacts system functionality and may not be appropriate for every user or environment.

If you’re using this guide, you should be an experienced Mac OS X user, be familiar with the Mac OS X user interface, and have experience using the Terminal application’s command-line interface. You should also be familiar with basic networking concepts. Some instructions in this guide are complex, and use could cause serious effects on the computer and its security. These instructions should only be used by experienced Mac OS X users, and should be followed by thorough testing.

So clearly these “good” documents are not that good for everybody. In any case, Spotlight doesn’t index /System because that could be a security problem on its own (it would need permissions to do that, a set of permissions that you don’t want to give to a userland daemon running all the time, with access to a UI). Why would a regular user want to keep an index of /System remains a mystery to me, it only has things that are for the System and not for the user to find and manipulate.

You can, however, use the terminal to touch that if that’s what you want, but no user should ever attempt to land in /System, it can only break so many things…

Where did you get the idea that

  1. /System is the most important place to keep an eye on files ?
  2. Spotlight is a tool to keep an eye on files?

The place to keep an eye on files is in your very own /Users/YourFolder, because that’s all the access you should have (to write that is).

Spotlight is an indexing/searching tool, not a tool to monitor files that may seem suspicious in reserved system places.

All in all, if you still want those docs, I’m sure that most of them will be available in the developer’s area of Apple’s website. (developer.apple.com). You can create a free account and start from there.

On the other hand, if you are a “security professional” then you are using the wrong tools for your job. Spotlight is ok as it is, if anything, you might want to restrict it. I’m sure that if you make spotlight run as root it will eventually index that, but of all the possible ideas that come to my mind, that is probably one of the worst security ideas ever conceived. There’s a reason why root user is disabled by default, there’s a reason for sudo and there’s a reason for normal accounts. Use them wisely, use them in peace.

share|improve this answer
    
An excellent answer, you should have referenced this in your other answer. –  chiggsy Nov 16 '10 at 6:03
    
Answering the points raised, Spotlights metadata includes last modified time, allowing me to ask "What just changed?" As for root, I am root. It's my system, on my network. It phones all over the place, not just home. Undocumented in the included help. The "Firewall" only restricts incoming, not outgoing packets, and those outgoing packets are undocumented in the help, as are their destinations. I cross borders with that machine. My experience tells me that it is wise to know what your tools are doing, and to whom they speak to about your location, and actions. –  chiggsy Nov 16 '10 at 6:30
    
@Chig You can always use LittleSnitch, which I’m sure you know at this point. In any case, if you’re experimenting with a machine, then consider joining the Apple Developer program where you can get access to all the documentation that Apple provides. –  Martín Marconcini Nov 16 '10 at 10:16
    
I did join the dev program years ago. I am using the Snitch, but, and I mean no disrespect, that type of thinking turned out badly for me. I would get an app to do this, or that, because it was easy, and I became unfamiliar with the actual system. I'm sad about this, because there is a lot to love about the command line tools in osx. More importantly, when I got hacked, I tried to see what was running and had no clue. Essentially I just want to know what's running, and what it's doing, to find a baseline, so that when odd things happen, I'll know. –  chiggsy Nov 16 '10 at 23:41
    
@chiggsy I understand your concerns. Reading Mac OS X “Internals” is a good starting point if you haven’t already. (amazon.com/Mac-OS-Internals-Systems-Approach/dp/0321278542). I had the chance to take a look at that book and it certainly explains a lot of the “OSX” thing and differences with other OS. –  Martín Marconcini Nov 18 '10 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.