News for hackers. Stuff that matters.

A comment on Critical SIP Bypass Vulnerabilities in macOS PackageKit.framework. Parent comment

Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by dangrie158 on Sunday July 31, 2022 @01:47AM (#32293511)
Does not seem Privilege free as it seems to need sudo to run the client to connect to the service?
[ Parent | on HN ]
Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by azinman2 on Sunday July 31, 2022 @02:17AM (#32293632)
My thoughts exactly. If you can sudo, isn’t it already game over?
[ Parent | on HN ]
Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by eslaught on Sunday July 31, 2022 @02:31AM (#32293694)
But that was the entire point of SIP, wasn't it? To mitigate the impact of a compromised root account. If it doesn't work, then what's the point of going to all this effort in the first place?
[ Parent | on HN ]
Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by j16sdiz on Sunday July 31, 2022 @02:32AM (#32293698)
Think SELinux.

sudo is bad, but it is not worse.

Like SELinux, you are not supposed to be able to disable without reboot.

[ Parent | on HN ]
Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by fignews on Sunday July 31, 2022 @04:37AM (#32294235)
Wouldn’t `setenforce 0` be essentially “disabling” SELinux without a reboot?
[ Parent | on HN ]
Re:Critical SIP Bypass Vulnerabilities in macOS PackageKit.f... by OJFord on Sunday July 31, 2022 @07:21AM (#32294818)
Puts it in 'permissive' mode, i.e. 'audit but don't deny'. Disabling (i.e. no auditing either, no record) requires a reboot I believe (a change to kernel param).
[ Parent | on HN ]