After having successfully compiled bash and sh for OS X Mavericks our OS X Server's System Log is flooded every 2 or 3 seconds with:

... kernel[0]: CODESIGNING: rejected new signature for architecture 16777223 of file /bin/sh
... kernel[0]: proc 59029: load code signature error 4 for file "sh"

There are no complaints about bash, only sh.

What is going on and what can I do to fix it?

  • 2
    This is one of many reasons why system binaries shouldn't be replaced in general. – grg Sep 25 '14 at 19:51
  • @grgarside oh for an ideal world - without vulnerabilities like ShellShock and with plenty of time to await Apple fixes; which we didn't feel we had to protect the integrity of our OS X Server. – iainH Sep 26 '14 at 15:13
up vote 3 down vote accepted

I have observed the same error when deploying my own signed apps. It appears that if you mv/cp a new binary over an existing signed one, the kernel does not keep track of this very well and starts generating these errors. I have found that this does not occur if the new binary is installed as part of a package, or if the original binary is deleted first and then the new binary put in place. Additionally once in this situation, a reboot fixes the issue, presumably as the kernel codesigning table is stored in memory. I appreciate rebooting may not be an option in a server environment.

  • Rebooting fixed the problem. i.e. no more CODESIGNING errors were logged wrt the new /bin/sh after restart. I was nervous of rebooting with an iffy sh in case I locked myself out of our server. But I needn't have worried. The OS X Server is running smoothly. Thanks to @SillyWilly for confidence-enabling answer. BTW the whole exercise was as a fix to the "shell shock" vulnerability. (See apple.stackexchange.com/questions/146849/…) – iainH Sep 26 '14 at 15:02

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.