w0lfschild/mySIMBL

System Integrity Protection info

starksm64 opened this issue · 14 comments

starksm64 commented

In the link you give for disabling SIP, there is an answer from Rich Trouton indicating that one can have SIP enabled but disable various restrictions. He also has the following more detailed posting on the subsets of protections:
https://derflounder.wordpress.com/2015/10/01/system-integrity-protection-adding-another-layer-to-apples-security-model/

Is there a subset of restrictions that one can remove for mySIMBL to function without fully disabling SIP?

w0lfschild commented
  • If you're on 10.13 or below you can run mySIMBL with SIP on after installing the helper.
  • If you're on 10.14 or above you must run mySIMBL with SIP off.

Edit: Mojave info

SaSaSushi commented

Are future updates going to enable running mySIMBL in 10.14 with SIP on?

I'm hoping yes because I really prefer not to run with SIP disabled and may roll back to High Sierra.

npyl commented

@w0lfschild What is it that mySIMBL does that requires SIP to be disabled? Maybe I could make a patch if I knew??

Also, @SaSaSushi you will only have to disable once SIP, just for the installation. After this is complete, you can re-enable it...

npyl commented

I noticed the installSIMBL script installs the SIMBL.osax into /System/Library/ScriptingAdditions while it seems logical that it could be installed in /Library/ScriptingAdditions and this way keep SIP untouched.

Check out a snippet:

mySIMBL=$(dirname "$0")
cp -vr "$mySIMBL"/SIMBL.osax /System/Library/ScriptingAdditions/
cp -vr "$mySIMBL"/SIMBLAgent.app "/Library/Application Support/SIMBL/"
cp -v "$mySIMBL"/SIMBLAgent.app/Contents/Resources/net.culater.SIMBL.Agent.plist "/Library/LaunchAgents"

I am not sure if there is a good reason for this or it is just legacy code from SIMBL project but I believe this would remove the SIP restriction.

I could make a pull request if you like.

SaSaSushi commented

Thank you very much. I would appreciate the pull request.

Please pardon my ignorance, but is there any way I could manually move the file in the meantime?

When I disable SIP, the Afloat plugin works perfectly but it stops working the moment it is reenabled.

npyl commented

I experimented a bit with mySIMBL and mySIMBLFramework (handles installation) and I believe I have replaced every critical part of the program that uses /System with the /Library corresponding directory.

Though, plugin loading doesn't work (with or without SIP) so I am going to investigate a bit more...

@SaSaSushi Even if you move the file to /Library, mySIMBL won't be able to find it. I will investigate a bit more and see if I can create a good PR which will actually work. I will also upload my fork of the projects so that you can maybe compile it if you want.

SaSaSushi commented

Thank you, npyl! I really appreciate it if you can get it working.

Yes, I found out that just moving the file doesn't work since the app doesn't see it and just prompts to install it again in /System/Library/ScriptingAdditions.

I will definitely try compiling with your changes if you get it working.

For now I'm running with SIP disabled. Thanks again.

npyl commented

That's great, I am gonna check it out right now

npyl commented

I got some news:
A. The place mySIMBL installs SIMBL.osax is not the major reason we disable SIP. mySIMBL requires SIP permanently disabled on Mojave to work due to enhanced restrictions by apple.

B. You don't have to fully disable SIP, you can partially disable it just for SIMBL to work using: csrutil enable --without debug

PS: I just noticed @w0lfschild mentions that disabling SIP is mandatory on Mojave, in a previous message.

SaSaSushi commented

Thank you, npyl. I have enabled SIP without debugging and note the following now:

`System Integrity Protection status: enabled (Custom Configuration).

Configuration:
Apple Internal: disabled
Kext Signing: enabled
Filesystem Protections: enabled
Debugging Restrictions: disabled
DTrace Restrictions: enabled
NVRAM Protections: enabled
BaseSystem Verification: enabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.
`
It's better to have some SIP than no SIP I suppose although the bit about leaving the machine in an unknown state in the future is a bit concerning.

Will there be no way to work around this to get mySIMBL working with full SIP in the future?

Thanks again for your help!

npyl commented

@SaSaSushi To be honest I think no because it will always rely on code injection which is prohibited by SIP. I am no expert though so... 🤷‍♂️

Glad it worked for you though! :)

w0lfschild commented

@npyl is correct.

  • Mojave and onward will always require SIP to be disabled

  • The install location is /System for a few reasons

    • On 10.10 - 10.13 if SIP is enabled injection will only work if the OSAX is in /System
    • On 10.14 and above injection will only work if SIP is off AND the OSAX is in /System
npyl commented

@w0lfschild Is there any other way that SIMBL would work without injection? Like, a different "injection" method?

w0lfschild commented

@npyl

Nope and even if there was another way it would 100% be patched in the next macOS release.

Code injection is a security risk that Apple is clearly against the average user being exposed to.

  • 👍3