1

I have a very complex application that needs a directory in /usr. By complex, I mean it would take thousands of changes to rid the code of /usr references. It has to be done, but I need a newer OS X immediately. When I attempted to upgrade an older OS X system, it wiped this directory as part of the installation. If I run the csrutil disable on the system, place the /usr subdirectory back where it goes, will ongoing OS X security updates within the Mojave version (10.14, not OS major upgrades) purge the directory when applied, or leave it in place?

|improve this question
  • 2
    It's not clear why you need both a pre-El Capitan security model and a cutting edge version of macOS. Is this not something that can be run in a VM (i.e. Yosemite as a guest VM on a Mojave host)? For the record, /usr is protected, but /usr/local is excluded from SIP. See: support.apple.com/en-us/HT204899 – Allan Oct 3 '18 at 18:36
  • 10.14 is only necessary because it is the system I was going to move the site onto. The directory is a legacy web directory with a few million files, c program binaries and scripts, many of which I'm not even familiar with. It has to be moved to ssl and that is the real driving force (and in the present, somewhat of an emergency). I can move it in place, but then it's depending on very old security implementations. It's also not in /usr/local. I'd felt that putting it on a modern OS would be safer even with SIP disabled. Thanks for the interest. – TreedEagle Oct 3 '18 at 18:51
  • It's not the OS per se, it's how the web server (i.e. Apache) is implemented and configured. macOS 10.14 doesn't give you any more security than 10.9 if you disable it's core security feature. Apache 2.4 and PHP 7.1.x/7.2.x both run on 10.9 – Allan Oct 3 '18 at 18:57
  • Allan, that is somewhat comforting advice, I have decided to implement in place and deal with the SIP issues at leisure prior to upgrading the OS since as you point out, I'd be defeating the one advantage the new OSs have. That is in keeping with opinion on security of 10.9. Of course the target would be to have the SIP security eventually. – TreedEagle Oct 4 '18 at 15:28
  • Fwiw, I really don't think SIP is going to make a web server any more or less secure against a remote attacker, at all. It's a feature for programs run on the local machine. – Wowfunhappy Jan 30 at 21:10
0

There is no way of knowing in advance. Security and minor upgrades replace these parts of the system which Apple considers relevant/in need of fixing. While the chance that the whole /usr gets replaced is probably small it may not be very wise to rely on it.

|improve this answer
  • I was afraid of that. The answer makes sense. I have not been watching how updates might impact this and was hoping that historically, even though they could, only major upgrades have wiped /usr sub-directories as had happened when I attempted upgrade of another Yosemite system to El Capitan long ago. If no other responses come in with information concerning past occurrences of updates wiping the subs, I will mark this as the answer. Thank you. – TreedEagle Oct 3 '18 at 18:57
  • @TreedEagle Even if historically /usr remained untouched there is no guarantee that it would remain so in the future. In your position I probably would just write a script which rebuilds whatever I need in /usr and then rerun it after each update. – nohillside♦ Oct 4 '18 at 14:03
  • 1
    Good approach if I were to continue on the upgrade path. This discussion has convinced me that just bringing the server up on ssl first, then addressing the move to a non-/usr sub-directory is most prudent. – TreedEagle Oct 4 '18 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .