Took me too long to realize SIP in this context is "System Integrity Protection" not "Session Initiation Protocol". Please spell out acronyms before using them.
The first usage I see of "SIP" after the title is in parenthesis after the full phrase.
The ‘app’ you can’t trash: how SIP is broken in High Sierra
41–50 of 100 posts
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#42-"MacOs is too closed! Apple lock the user" (Now you can install kernel extensions) -"It's insecure!
> (Now you can install kernel extensions)
This is wrong. There is no "now." Kernel extensions have been installable in macOS since 10.0, IIRC. The real "issue" here is that Apple has provided a mechanism for installing Kernel extensions into a protected bucket, but no way to uninstall them.
The fact that this whole thing isn't very well (or at all) documented even for developers (the ones writing the kernel extensions), seems like it's not the most ideal of situations.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#43Applying SIP on the KEXT makes sense, since any KEXT that’s writable by the user is a huge security risk. The only thing that appears to be broken here is the BlueStack uninstaller that is apparently not SIP-aware. There’s probably some way to do the SIP procedure you did to install the app in reverse.
The point of the article is that there's no documented way to do the SIP procedure in reverse.
https://developer.apple.com/library/content/technotes/tn2459... gives some more info on the process for approving installation, but doesn’t mention extension unloading or removal.
Neither does https://support.apple.com/en-us/HT208019, but I would guess/hope that, if you are managing Macs running High Sierra through MDM, you _can_ do that.
Also, if you are using MDM, be prepared for a change (from that second document):
“If your Mac is running macOS High Sierra and is enrolled in MDM, User Approved Kernel Extension Loading is currently disabled. All kernel extensions will load without requiring user consent. Use the Kernel Extension Policy payload to specify which kernel extensions should load without user consent, and to optionally prevent users from approving additional kernel extensions.
In spring 2018, an update to macOS will cause User Approved Kernel Extension Loading to be enabled even on devices enrolled in MDM. You will still be able to use the Kernel Extension Policy to manage User Approved Kernel Extension Loading after this change.”
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#44Yes it's boring. DTrace is broken too thanks to SIP.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#45This post annoys me for describing a problem which other people might encounter with a good level of detail but uses “broken” to get clicks rather than the more accurate “I don’t understand or agreee with the security model”. As misnome and others have noted, if someone loads a malicious kext the only safe option is a complete wipe and reinstall – or depending on how much you trust Apple’s firmware signing, buying a…
I agree with the post --- this is broken behaviour regardless of whether you agree with the security or not --- if you have permissions to install something, you should also have permissions to remove it, and vice-versa. If you're really into "higher security", then saying they shouldn't have the permissions to install it in the first place would also make sense, but this weird "can install but can't remove" doesn't.
Then the fix is a kext manager where you can remove kexts. Sure it's just language but broken is a tad strong, even though I tend to agree with you.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#46Earlier quoted context omitted.
It’s exaggerated but only slightly. Some of the worst messes I’ve seen were people who should have known better just blindly pasting google search results because they didn’t have time to do it right. More developers than sysadmins but definitely not exclusively so. Never underestimate the degree to which people are rushing or not questioning whether their initial diagnosis was correct.
I would add that these kinds of "Normal users click accept/next" are how "offers" on software gets installed. Case in point: uTorrent. Download and "install". You will, generally, get 2 screens that install junk. On one screen you can click "Decline". On another, you can click "Skip". These screens are between all the normal "which folder", "do you accept" and "thank you" screens. Case in point: Adobe Reader... downl…
I've been burned enough by bad installers that I go to ninite for any software like that.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#47I'm glad I didn't upgrade.
Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#48I'm glad I didn't upgrade. Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc.
It took Linux/BSD years to get it right, too. It often takes a long time for the user-facing interface to catch up to the kernel functionality.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#49Took me too long to realize SIP in this context is "System Integrity Protection" not "Session Initiation Protocol". Please spell out acronyms before using them.
The first usage I see of "SIP" after the title is in parenthesis after the full phrase.
Yes, but halfway through the article. It is a mystery until then.
Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra
#50Earlier quoted context omitted.
It’s exaggerated but only slightly. Some of the worst messes I’ve seen were people who should have known better just blindly pasting google search results because they didn’t have time to do it right. More developers than sysadmins but definitely not exclusively so. Never underestimate the degree to which people are rushing or not questioning whether their initial diagnosis was correct.
I would add that these kinds of "Normal users click accept/next" are how "offers" on software gets installed. Case in point: uTorrent. Download and "install". You will, generally, get 2 screens that install junk. On one screen you can click "Decline". On another, you can click "Skip". These screens are between all the normal "which folder", "do you accept" and "thank you" screens. Case in point: Adobe Reader... downl…
What about the High Sierra notification itself? The only options are "install" and "details"