Slashdot Mirror
Understanding Mac OS X Kernel
An anonymous reader writes "Kernelthread.com has published a flash presentation overview of the Mac OS X kernel. Its title is 'A Tour of the Mac OS X Kernel' and it also covers Tiger features. Maybe interesting to note is that the slides are from a talk given to the NSA. Well, there is a nice security architecture diagram towards the end of the presentation."
A flash presentation that didn't turn my p4 into a 386!
Apparently not:
http://en.wikipedia.org/wiki/AES#Security
Does it give away the kernel's secret recipe?
You're wrong.
d ard
Maybe you're thinking of the old DES standard.
http://en.wikipedia.org/wiki/Data_Encryption_Stan
There is no way to step back (at least I found none), to get an overview, to jump to a certain frame (like the mentioned security architecture diagram) - why do people make presentations in flash, instead of pdf or css (example)?
I'm willing to bet it's in Flash because he did the presentation in Keynote. While the SWF export in Keynote isn't great, at least it preserves transitions, fonts, and other formatting options and doesn't look like shit (like the HTML export of another presentation software).
Plus, it takes one step to export. I haven't seen anything that will do that with CSS.
Per Square Mile, a blog about density
So HFS+ can only support file sizes up to 8 exabytes. What a worthless filesystem.
nil
FS and swap encryption is used to encrypt user's home directories. This is the "File Vault" functionality of OS X. Tiger adds the ability to optionally encrypt the users swap space also (only on file vaulted home folders) to secure the users memory space as well. A file vaulted home folder becomes a sparse disk image file (a disk image that can grow in size as it's written too) that uses the users account password to open. If the user losses their account password then the admin can use the master file vault (set separately) to restore the users home directory. That scenario only really applies for multi-user systems.
I am not sure what bit of AES is used though. I would guess 128 bit at least.
If you look closely, the slide with the Architecture (3 or 4 in) has more info. in that black block. It's hard to see though.
Pedantic note:
____
Now my head hurts
Gives you a popup when done in cinjuntgion with mouse over the presentation. At least it does in Safari.
I'm willing to bet it's in Flash because he did the presentation in Keynote.
Too bad he didn't export it to PDF. Keynote 2 (the version that ships in iWork 05) has an excellent PDF exporter.
How the hell do I turn that on. Case preserving sucks ass when interacting with case-sensitive system...
Use FTP to mount a remote webserver. Attempt to copy all the files to a local directory for modification. Finder complains 'some files differ in case and only one will be copied. Continue?" Would it be that fucking hard to list the files that conflict and give me the option to rename them? Jeeze.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
I find it interesting that parts of the Kernel were written in Embedded C++. I haven't had the opportunity to use this although I'd love too. Anyone have an experience with EC++ they'd like to share?
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Wow.. So it looks like they finally fixed this security bug where the password could be discovered in the swap. Anyone know how to turn this feature on? (don't have Tiger yet & a quick Google search turns up nothing)
In the same vein, I recall OS X versions up to jaguar had weakly-hashed user passwords in a SAMBA directory somewhere. If I'm remembering correctly, can someone verify that this is no longer the case in Tiger?
W
-------------------
This is my SIG. There are many like it, but this one is mine.
what do we have here? a osx-slash-dotter who doesn't read macosxhints.com? look here:
1 027224603111&query=case-sensitive
s ensitive&type=stories&mode=search&keyType=all
http://www.macosxhints.com/article.php?story=2003
and don't forget to watch out for the trouble:
http://www.macosxhints.com/search.php?query=case-
regards, n.
Mac%20OS%20X%20Kernel%20Presentation?
For some reason, EVERY non-alphanumeric character is coming up in the hex format.
Never hit your grandmother with a shovel, for it leaves a bad impression on her mind...
I take it nobody with a Windows box even tried to view the presentation. All of the space characters are rendered as "x20", which makes it a bit tough (nee impossible) to read.
Sorry to dint your tinfoil body suit, but the reason the NSA is interested in OS X is because they use OS X. I have a very interesting, very thorough PDF authored by the NSA (report #I331-009R-2004) on how to secure an OS X box, from install through end use. Very interesting, and I learned a bit.
I am a believer of momentum and curves.
At least they could call it a P5. Some consolation.
The NSA is not allowed to break US laws. Of course, they spy on other countries, so they're probably allowed to break other countries' laws.
As for the other nasty stuff, it sounds an awful lot like your tinfoil hat is on too tight.
Also, if you want to hack a computer, you probably care more about the services running on it than the guts of the kernel, at least up to the point where you install a rootkit. They probably care more because they want to use MacOS X in a highly secure environment. SEDarwin anyone?
I hereby place the above post in the public domain.
It's shocking how ignorant people are of the activities of the U.S. government. Look at some of the other replies to the parent post.
Most openly managed organizations have great difficulty staying on track. Secret organizations develop bad habits very quickly. In secret organizations, cover-ups become habit. Even the cover-ups themselves can be kept secret from other people in the same organization.
Supposedly, U.S. spy agencies are not allowed to break U.S. laws. However, organizations that hire people to break the laws of other countries don't suddenly have moral control over the law-breakers when they return to the United States.
Bummer :-(
I've used the NSA guide for Cisco IOS extensively, and have looked through the Mac OS X one. It's a great running start to securing a new box. But like any security process, you can't stop there.
try again?