Kernel Security Levels

buc99

Don't Tread on Me!
Does anyone know if OSX has different security levels that can be set in the kernel? A friend of mine was telling me of this feature in BSD kernels and I was wondering if Apple adopted this in their kernel. If so, does anyone know of how you set different security levels in the kernel?

Thanks,
SA:)
 
If you mean the kern.securelevel sysctl option, it is present:

Code:
$ sysctl -a |grep kern.secure
kern.securelevel = 1

The big question is whether or not the kernel actually uses this; as shown above, mine is currently 1, but I can't find where it is set (on my OpenBSD machine, it's set in /etc/rc).
 
see:
man sysctl

Very interesting. I'll quote parts here:
Code:
The sysctl utility retrieves kernel state and allows processes with ap-
     propriate privilege to set kernel state.  The state to be retrieved or
     set is described using a ``Management Information Base'' (``MIB'') style
     name, described as a dotted set of components.  The -a flag can be used
     to list all the currently available string or integer values.  The -A
     flag will list all the known MIB names including tables.  Those with
     string or integer values will be printed as with the -a flag; for the
     table values, the name of the utility to retrieve them is given.

     The -n flag specifies that the printing of the field name should be sup-
     pressed and that only its value should be output.  This flag is useful
     for setting shell variables.  For example, to save the pagesize in vari-
     able psize, use:
           set psize=`sysctl -n hw.pagesize`

     If just a MIB style name is given, the corresponding value is retrieved.
     If a value is to be set, the -w flag must be specified and the MIB name
     followed by an equal sign and the new value to be used.

     The information available from sysctl consists of integers, strings, and
     tables.  The tabular information can only be retrieved by special purpose
     programs such as ps, systat, and netstat. The string and integer informa-
     tion is summaried below.  For a detailed description of these variable
     see sysctl(3).  The changeable column indicates whether a process with
     appropriate privilege can change the value.
*snip*
Code:
Name                            Type          Changeable
kern.securelevel                integer       raise only

hmm There's more in the man file, btw


I think, btw:
sysctl -w kern.securelevel=2
might change it

but I wouldn't mess with it!
 
Back
Top