search

droe / xnumon

monitor macOS for malicious activity
https://www.roe.ch/xnumon
Open Software License 3.0
230 stars 30 forks source link

Verify identity of process attaching to cdev #45

Open droe opened 5 years ago

droe commented 5 years ago

The kext should verify the identity of the userspace process attaching to /dev/xnumon based on its code signature and refuse attaching if the code is unsigned or signed by the wrong team.

droe commented 5 years ago

This seems not to be easily possible with the current cdev interface and using supported KPIs only, because the KPIs in bsd/sys/codesign.h are private.

droe commented 5 years ago

Reference: https://forums.developer.apple.com/thread/108803