MacOS client installer not working!

Question

MacOS client installer not working!

Opened this issue a year ago · 2 comments

The MacOS client installer pkg for 3.4.6.8 on the latest Ventura release 13.4.1 does not work. The installer runs and says successful but does nothing -- these launchd files are not created:

/etc/grr.local.yaml
/Library/LaunchDaemons/com.google.code.grr.plist

Moreover, the alternative installation instructions (using apt-get) have not been relevant for years, leaving RAM on fleets of recent developer Macbooks unmonitored.

Can anyone point me to the GRR scripts used for memory acquisition on Macs? From the docs, I understand that Yara is used for analysis with a presumably modified dependency for acquisition, since Yara itself does not appear to handle acquisition on Macs. This is actually all I want to do -- can anyone point me to a solution?

Answer 1 · 2023-07-20T19:08:36.000Z

The MacOS client installer pkg for 3.4.6.8 on the latest Ventura release 13.4.1 does not work. The installer runs and says successful but does nothing -- these launchd files are not created:

How is your GRR server deployment configured? Is Fleetspeak enabled?

Moreover, the alternative installation instructions (using apt-get) have not been relevant for years, leaving RAM on fleets of recent developer Macbooks unmonitored.

I'm not sure I follow - could you please share a link? I'm not aware of alternative installation instructions using apt-get, as apt-get is a Linux package management tool that, as far as I know, is not used on Macs.

Can anyone point me to the GRR scripts used for memory acquisition on Macs? From the docs, I understand that Yara is used for analysis with a presumably modified dependency for acquisition, since Yara itself does not appear to handle acquisition on Macs. This is actually all I want to do -- can anyone point me to a solution?

Memory acquisition on recent macOS versions unfortunately doesn't work, as Apple has locked down memory reading capabilities (short summary: process memory can only be read if the binary of the process of interest has a special debug bit set). Raw memory acquisition is not possible as well, as the kernel drivers system was also locked down and migrated to well-defined APIs in recent macOS versions.

Answer 2 · 2023-07-20T21:22:07.000Z

I've simply run the latest Docker image, no Fleetspeak, and tried to get a client installed on the same Ventura machine. Pardon, the macOS client instructions here: https://grr-doc.readthedocs.io/en/latest/deploying-grr-clients/on-mac-os-x.html point to Linux instructions with dpkg and rpm, not apt-get -- I misremembered. Either way, doesn't work. And all for naught if Apple has locked memory access! Aye, that figures! I have an old 2012 MBP that I can roll back and try Rekall on, maybe. Otherwise, will have to try this on a Pinebook or some other Linux machine.

…

------- Original Message -------

On Thursday, July 20th, 2023 at 2:08 PM, mbushkov ***@***.***> wrote: > The MacOS client installer pkg for 3.4.6.8 on the latest Ventura release 13.4.1 does not work. The installer runs and says successful but does nothing -- these launchd files are not created: How is your GRR server deployment configured? Is Fleetspeak enabled? > Moreover, the alternative installation instructions (using apt-get) have not been relevant for years, leaving RAM on fleets of recent developer Macbooks unmonitored. I'm not sure I follow - could you please share a link? I'm not aware of alternative installation instructions using apt-get, as apt-get is a Linux package management tool that, as far as I know, is not used on Macs. > Can anyone point me to the GRR scripts used for memory acquisition on Macs? From the docs, I understand that Yara is used for analysis with a presumably modified dependency for acquisition, since Yara itself does not appear to handle acquisition on Macs. This is actually all I want to do -- can anyone point me to a solution? Memory acquisition on recent macOS versions unfortunately doesn't work, as Apple has locked down memory reading capabilities (short summary: process memory can only be read if the binary of the process of interest has a special debug bit set). Raw memory acquisition is not possible as well, as the kernel drivers system was also locked down and migrated to well-defined APIs in recent macOS versions. — Reply to this email directly, [view it on GitHub](#160 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/BBM6COSZXVU7WTZQKQDKILLXRF637ANCNFSM6AAAAAA2R2UK6A). You are receiving this because you authored the thread.Message ID: ***@***.***>