0

The question should be clear from the title. If System Integrity Protection, aka Rootless, is part of Darwin, then I might be interested in inspecting how it is implemented. I would be grateful if someone could point me to the relevant files or packages. I think it definitely should be in xnu, by the way, because it has to be in the kernel, but I'm also interested in how other packages interact with it, e.g., file_cmds.

I guess this question can only be answered on Darwin 15.0.0's source code is released on https://opensource.apple.com/ (it's not yet available as of right now).

Improve this question

1 Answer 1

Reset to default
1

SIP is exposed to the file handler code as a new "restricted" class flag ACL as if it were stored in the file system metadata, so the code required to prevent all writes would be fairly transparent to implement so that all other packages would just get an enoperm error if my suspicions are correct.

You are correct that we don't have a source dump yet for 10.11 so I reserve the right to be totally wrong about my suspicions.

Improve this answer
1
  • Makes sense. We'll see when the source is out.
    – 4ae1e1
    Commented Sep 30, 2015 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .