Timeline for Protect hosts file
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 17, 2017 at 12:38 | comment | added | MFJC |
@grgarside when I check the manual for chflags they don't mention the restricted option, is there a way to get a more detailed command manual than the BSD General Commands Manual widely used online (including the Apple Developer Site) ?
|
|
| May 17, 2017 at 11:39 | comment | added | MFJC |
@grgarside when we do the csrutil technique you mentioned, is there a way to verify the protection on that file has been activated like when verifying permissions for a folder or file for example ?
|
|
| May 17, 2017 at 11:33 | comment | added | MFJC | @grgarside ok great, thanks a lot for taking time to answer my questions. Is there an official hosts file to check against to see what the regular hosts file should look like ? | |
| May 17, 2017 at 10:33 | comment | added | grg♦ | @Espressotron Restricted files can still be read, SIP doesn't protect against reading the file as that's not its purpose. I'm not sure I understand what you mean by threat — many processes read the hosts file and they shouldn't be prevented from doing so, but writing is a different thing and rarely needs to be performed. Apps shouldn't be writing to hosts except in very rare circumstances, so having an error or other caught exception is part of the protection. Should Apple ever wish to edit the file in a macOS update, their SU certificate bypasses SIP as designed, so this is not an issue. | |
| May 17, 2017 at 10:32 | comment | added | MFJC | @grgarside Also can this protection using csrutil cause some apps or services to bug ? | |
| May 17, 2017 at 10:27 | comment | added | MFJC | @grgarside Thanks. So this csrutil trick helps you prevent modification but an attacker can still read the file right ? Can this pose a threat with a normal non custom hosts file? | |
| Apr 30, 2017 at 12:26 | history | edited | grg♦ | CC BY-SA 3.0 |
deleted 36 characters in body
|
| Apr 30, 2017 at 12:10 | vote | accept | CommunityBot | ||
| Apr 30, 2017 at 12:06 | comment | added | grg♦ |
@pealo86 By “previous command” I meant the noschg command I mention after — run sudo chflags noschg /etc/hosts to remove the protection.
|
|
| Apr 30, 2017 at 12:00 | comment | added | user206728 |
ah I see what you mean about not being able to make modifications actually! it now gives me an error when I try to write-out the hosts file... that should do nicely then. Im struggling to undo the sudo chflags schg command however, if I run it again I am still unable to modify hosts?
|
|
| Apr 30, 2017 at 11:54 | comment | added | grg♦ | @pealo86 Unfortunately I have no experience with modifying the security level, perhaps someone else will be able to help with explaining any impacts this may have. As for opening with nano, this doesn't prevent access to the file, only modifications — try writing out with nano to the file? | |
| Apr 30, 2017 at 11:52 | comment | added | user206728 |
also I've tried running sudo chflags schg /etc/hosts in Terminal but I am still able to access the hosts file with sudo nano /etc/hosts... is this normal?
|
|
| Apr 30, 2017 at 11:49 | comment | added | user206728 |
thanks! I am running Yosemite so looks like schg is the only option then... my kernel security also appears to be set to 0, is there a way to increase this?
|
|
| Apr 30, 2017 at 11:28 | history | edited | grg♦ | CC BY-SA 3.0 |
added 642 characters in body
|
| Apr 30, 2017 at 11:22 | history | answered | grg♦ | CC BY-SA 3.0 |