Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I tried to setup the kern.tfp.policy to one but it does not let me do it.

sudo sysctl -w kern.tfp.policy=1

kern.tfp.policy: 2 sysctl: kern.tfp.policy: Invalid argument

How can I set kern.tfp.policy=1.

I am doing this in order to be able to use mach_inject.

Thanks

share|improve this question
What are you trying to accomplish? Have you tried adding your user account to procmod group? – Daniel Beck♦ Oct 31 '11 at 13:01
I am trying to change the security policy for task_for_pid(); which is used in mach_inject. – Rahul Oct 31 '11 at 14:26
I will hook some APIs from Quartz. – Rahul Oct 31 '11 at 15:44
I read somewhere that adding an account to the procmod group is just as good (although not system-wide), would this work for you? – Daniel Beck♦ Oct 31 '11 at 19:26
I tried that option.. adding account to the procmod takes time, changing the policy should be instantaneous. I cannot ask user to wait for some time after installation of software. It should work right away. Its requirement. – Rahul Nov 1 '11 at 9:35

1 Answer

up vote 4 down vote accepted

This option has completely been removed from the Mac OS X kernel five years ago.

In XNU 792 (Mac OS X 10.4.x Tiger), it still existed:

#define KERN_TFP_POLICY_DENY        0   /* Deny Mode: None allowed except privileged */
#define KERN_TFP_POLICY_PERMISSIVE  1   /* Permissive Mode: related ones allowed or privileged */
#define KERN_TFP_POLICY_RESTRICTED  2   /* Restricted Mode: privileged or setgid and realted */

In the more recent XNU 1228 (Mac OS X 10.5.x Leopard) it's been removed:

#define KERN_TFP_POLICY_DENY        0   /* Deny Mode: None allowed except privileged */
#define KERN_TFP_POLICY_DEFAULT     2   /* Default  Mode: related ones allowed and upcall authentication */

Since 1 is not a valid value for this option anymore, your call fails with that error message.

It seems there's no way to circumvent this anymore, so you'll have to use the procmod group membership.

As a workaround, look into man taskgated. It has a parameter that allows Tiger compatibility, as well as a few others.

Accepts the old (Tiger) convention that a process with a primary effective group of procmod or procview is allowed to get task ports. Without this option, this legacy mode is not supported.

You'd probably need to change the launchd plist and relaunch that service. Not sure if that's possible with your use case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.