Re: [MacPorts] #66358: sip-workaround / trace mode no longer works on arm64 macOS ≥ 13 due to new security features

MacPorts noreply at macports.org
Tue Nov 5 18:08:27 UTC 2024


#66358: sip-workaround / trace mode no longer works on arm64 macOS ≥ 13 due to new
security features
-------------------------+------------------------------------------
  Reporter:  reneeotten  |      Owner:  Clemens Lang <neverpanic@…>
      Type:  defect      |     Status:  reopened
  Priority:  Normal      |  Milestone:
 Component:  base        |    Version:
Resolution:              |   Keywords:  arm64 ventura sonoma sequoia
      Port:              |
-------------------------+------------------------------------------

Comment (by markmentovai):

 Replying to [comment:66 neverpanic]:
 > Looking for testers of this PR on macOS 14; it works fine for me on
 macOS 15.1, but in CI on macOS 14, I see
 >
 > {{{
 > dyld[20831]: bad bind opcode 0x1E
 > …
 > Killed by signal: 6
 > }}}
 >
 > Now, that error message is completely unhelpful, because the code that
 prints it (https://github.com/opensource-
 apple/dyld/blob/master/src/ImageLoaderMachOCompressed.cpp#L1027-L1028)
 does so after moving the pointer that it prints (https://github.com
 /opensource-
 apple/dyld/blob/master/src/ImageLoaderMachOCompressed.cpp#L955). I'd still
 like to know if this happens in regular usage on macOS 14, or whether it's
 just a corner case I am triggering with my test.

 The message you’re quoting from the source (`bad bind opcode %d in bind
 info`) doesn’t even match the error you’re seeing (`dyld[20831]: bad bind
 opcode 0x1E`). You’re looking at super-old dyld source from an unofficial
 dump of Apple’s old opensource site ([https://github.com/opensource-apple/
 github opensource-apple]), from before Apple pushed source to GitHub
 directly. It’s showing dyld-360.18 from 10.11.2 (2015-12-08), and it
 hasn’t been current since 10.11.3 (2016-01-19). I recommend that everyone
 purge that unmaintained opensource-apple dump from their bookmarks and
 workflow, and never consult it for any purpose. It’s outdated and
 misleading.

 Current Apple open-source drops are at ([https://github.com/apple-oss-
 distributions github apple-oss-distributions]), and dyld in particular is
 https://github.com/apple-oss-distributions/dyld. You can look at source
 specific to the macOS version you’re interested in, ranging from
 [https://github.com/apple-oss-distributions/dyld/tree/dyld-1122.1
 dyld-1222.1 from 14.0 (2023-09-26)] through [https://github.com/apple-oss-
 distributions/dyld/tree/dyld-1165.3 from 14.6 (2024-07-29)].

 Now, that doesn’t change the fact that, even 9 years later, the loop is
 still structured such that “bad bind opcode” still references the opcode
 that follows the one it’s actually complaining about. But given the proper
 current source, and the fact that there are 8 different loops that might
 result in `bad bind opcode 0x%02X`, you may find a loop that’s used for
 non-arm64e that’s missing handling for an opcode that the arm64e
 equivalent does handle.

  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOAnalyzer.cpp#L1535
 common/MachOAnalyzer.cpp:1535 in dyld3::MachOAnalyzer::forEachBind],
 handles 13 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOAnalyzer.cpp#L1700
 common/MachOAnalyzer.cpp:1700 in dyld3::MachOAnalyzer::forEachBind],
 handles 13 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOAnalyzer.cpp#L2170
 common/MachOAnalyzer.cpp:2170 in
 dyld3::MachOAnalyzer::parseOrgArm64eChainedFixups], handles 10 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOAnalyzer.cpp#L5070
 common/MachOAnalyzer.cpp:5070 in
 dyld3::MachOAnalyzer::forEachBind_OpcodesWeak], handles 13 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOAnalyzer.cpp#L5179
 common/MachOAnalyzer.cpp:5179 in
 dyld3::MachOAnalyzer::forEachBind_OpcodesRegular], handles 13 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOLayout.cpp#L603
 common/MachOLayout.cpp:603 in
 mach_o::Fixups::parseOrgArm64eChainedFixups], handles 10 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOLayout.cpp#L1062
 common/MachOLayout.cpp:1062 in mach_o::Fixups::forEachBind_OpcodesWeak],
 handles 13 cases
  - [https://github.com/apple-oss-
 distributions/dyld/blob/dyld-1165.3/common/MachOLayout.cpp#L1171
 common/MachOLayout.cpp:1171 in
 mach_o::Fixups::forEachBind_OpcodesRegular], handles 13 cases

 [https://github.com/apple-oss-
 distributions/xnu/blob/xnu-10063.141.1/EXTERNAL_HEADERS/mach-o/loader.h#L1442
 The full suite of opcodes] is defined in `<mach-o/loader.h>`, the 14
 `#defines` beginning with the terminator `BIND_OPCODE_DONE`:

 {{{
 #define BIND_OPCODE_DONE                                        0x00
 #define BIND_OPCODE_SET_DYLIB_ORDINAL_IMM                       0x10
 #define BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB                      0x20
 #define BIND_OPCODE_SET_DYLIB_SPECIAL_IMM                       0x30
 #define BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM               0x40
 #define BIND_OPCODE_SET_TYPE_IMM                                0x50
 #define BIND_OPCODE_SET_ADDEND_SLEB                             0x60
 #define BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB                 0x70
 #define BIND_OPCODE_ADD_ADDR_ULEB                               0x80
 #define BIND_OPCODE_DO_BIND                                     0x90
 #define BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB                       0xA0
 #define BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED                 0xB0
 #define BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB            0xC0
 #define BIND_OPCODE_THREADED                                    0xD0
 }}}

 The ones that handle 13 cases omit `BIND_OPCODE_THREADED`. The ones that
 handle 10 cases omit `BIND_OPCODE_ADD_ADDR_ULEB`,
 `BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB`,
 `BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED`, and
 `BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB`.

 Given that we’re potentially putting an arm64e executable through a non-
 arm64e path, I’d first suspect a use of `BIND_OPCODE_THREADED`.

 `BIND_OPCODE_THREADED` was for an earlier form of chained fixups (“old
 arm64e”), while the newer form just uses `LC_DYLD_CHAINED_FIXUPS` and is
 available beyond just arm64e. With additional effort, it may be possible
 to apply further translations to chained fixups in this format to make
 them work more broadly.

 Your log message is too truncated to dig deeper. Do you have a link? What
 executable is your test operating on when you observe this failure? What
 specific OS version?

-- 
Ticket URL: <https://trac.macports.org/ticket/66358#comment:67>
MacPorts <https://www.macports.org/>
Ports system for macOS


More information about the macports-tickets mailing list