How to stop InternetSharing overwriting /etc/bootpd.plist

Question

I set up a /etc/bootpd.plist so as to protect my wireless network, and to manage statically attributed IP addresses.

Unfortunatly, when I start InternetSharing, this file is overwritten by a plist that I didn't find the source.

How may I avoid InternetSharing overwriting this file?

Should I put my modifications within the source of this overwriting file?

Answer 1

The chflags efficiently blocked InternetSharing from touching my configuration file, but caused a detected error:

com.apple.InternetSharing[1976]: dhcp_config_create: Unknown error: -1 Hence bootpd didn't start at all.

By studying the processes spawned by InternetSharing I finally build a way to circumvent this systematic and stupid overwriting of /etc/bootpd.plist.

InternetSharing creates a minimal /etc/bootpd.plist and then spawns 2 processes:

/usr/libexec/bootpd
/usr/libexec/natpmpd

I replaced the original bootpd by a simple shell script in charge of putting my source of /etc/bootpd.plist in place before firing the original bootpd code. Of course most of these commands have to be ran as root.

/usr/bin/sudo -s    
cd /usr/libexec
mv bootpd bootpd.orig
cat >bootpd <<eof
#!/bin/sh
cp /etc/bootpd.plist.src /etc/bootpd.plist
exec /usr/libexec/bootpd.orig "$@"
eof
chmod 755 bootpd

cd /etc
cat >bootpd.plist/src <<eof
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>allow</key>
    <array>
            <string>00:00:00:00:00:00</string>
            <string>...
    </array>
    <key>deny</key>
    <array>
            <string>...
    </array>
    <key>Subnets</key>
    <array>
            <dict>
                    <key>_creator</key>
                    <string>dan</string>
                    <key>allocate</key>
                    <true/>
                    <key>dhcp_router</key>
                    <string>10.0.2.1</string>
                    <key>lease_max</key>
                    <integer>86400</integer>
                    <key>lease_min</key>
                    <integer>86400</integer>
                    <key>name</key>
                    <string>10.0.2/24</string>
                    <key>net_address</key>
                    <string>10.0.2.0</string>
                    <key>net_mask</key>
                    <string>255.255.255.0</string>
                    <key>net_range</key>
                    <array>
                            <string>10.0.2.2</string>
                            <string>10.0.2.31</string>
                    </array>
            </dict>
    </array>
    <key>bootp_enabled</key>
    <false/>
    <key>detect_other_dhcp_server</key>
    <true/>
    <key>dhcp_enabled</key>
    <array>
            <string>en1</string>
    </array>
    <key>use_server_config_for_dhcp_options</key>
    <false/>
</dict>
</plist>
eof

The 2 arrays allow and deny let me define exactly which MAC addresses I will accept within my shared network and which one I will banish.

This protection is far from bullet proof, but is better than the total lack of protection provided by InternetSharing on a WEP Fi-fi network :).

Answer 2

sudo chflags uchg /etc/bootpd.list

The inverse operation for when you want to be able to change it again is

sudo chflags nouchg /etc/bootpd.list

Sets the "user immutable" flag on that file. It should prevent any process from changing it.

Be warned that you are messing with system level stuff! If InternetSharing absolutely requires a change here to function, it is likely that at the very least it will stop working and it could cause many subtle problem in other operation. If you have a spare drive lying around, taking a coffee break while you do a quick clone might be a good idea.

Answer 3

I tried the script replacement trick above and found it very useful! Many thanks!

At my configuration the only additional requirement was to change the bootpd.plist from:

<key>use_server_config_for_dhcp_options</key>
<false/>

to:

<key>use_server_config_for_dhcp_options</key>
<true/>

what instantly opens DNS support to my DHCP clients.

I guess one should remark that any later change of the Internet Sharing configuration will require additional change of the "/etc/bootpd.plist.src" by copying from the current "/etc/bootpd.plist".

In any way the for longer existing conflict between Internet Sharing and Server.app related to DHCP service shall be urgently solved at later Mountain Lion Server versions!