From 2b2fbff2dc2af6f47edda62cedd22b22d6c9d9e0 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 6 Jun 2014 12:14:27 -0700 Subject: Switch to a launch daemon for ChmodBPF. "Ah finally blew that varmint to Kingdom Come!" Change-Id: I4ef5f8692924772189af4158eddbc125c1c7d521 Reviewed-on: https://code.wireshark.org/review/2004 Reviewed-by: Guy Harris --- packaging/macosx/ChmodBPF/ChmodBPF | 84 +++++++++------------- packaging/macosx/ChmodBPF/README.macosx | 48 ------------- packaging/macosx/ChmodBPF/StartupParameters.plist | 4 -- .../macosx/ChmodBPF/org.wireshark.ChmodBPF.plist | 12 ++++ packaging/macosx/Makefile.am | 3 +- packaging/macosx/Read_me_first_gtk.rtf | 32 ++++++--- packaging/macosx/Read_me_first_qt.rtf | 27 ++++--- packaging/macosx/Scripts/chmodbpf-postinstall.sh | 10 +-- .../macosx/Wireshark_package.pmdoc/02chmodbpf.xml | 2 +- .../macosx/Wireshark_package.pmdoc/index.xml.in | 2 +- 10 files changed, 94 insertions(+), 130 deletions(-) delete mode 100644 packaging/macosx/ChmodBPF/README.macosx delete mode 100644 packaging/macosx/ChmodBPF/StartupParameters.plist create mode 100644 packaging/macosx/ChmodBPF/org.wireshark.ChmodBPF.plist (limited to 'packaging/macosx') diff --git a/packaging/macosx/ChmodBPF/ChmodBPF b/packaging/macosx/ChmodBPF/ChmodBPF index ba5e49ef92..7f16d328b7 100755 --- a/packaging/macosx/ChmodBPF/ChmodBPF +++ b/packaging/macosx/ChmodBPF/ChmodBPF @@ -1,56 +1,40 @@ #! /bin/bash -# - -. /etc/rc.common - -StartService () -{ - # - # Unfortunately, Mac OS X's devfs is based on the old FreeBSD - # one, not the current one, so there's no way to configure it - # to create BPF devices with particular owners or groups. BPF - # devices on Mac OS X are also non-cloning, that is they can - # be created on demand at any time. This startup item will - # pre-create a number of BPF devices, then make them owned by - # the access_bpf group, with permissions rw-rw----, so that - # anybody in the access_bpf group can use programs that capture - # or send raw packets. - # - # Change this as appropriate for your site, e.g. to make - # it owned by a particular user without changing the permissions, - # so only that user and the super-user can capture or send raw - # packets, or give it the permissions rw-r-----, so that - # only the super-user can send raw packets but anybody in the - # admin group can capture packets. - # +# +# Unfortunately, Mac OS X's devfs is based on the old FreeBSD +# one, not the current one, so there's no way to configure it +# to create BPF devices with particular owners or groups. BPF +# devices on Mac OS X are also non-cloning, that is they can +# be created on demand at any time. This startup item will +# pre-create a number of BPF devices, then make them owned by +# the access_bpf group, with permissions rw-rw----, so that +# anybody in the access_bpf group can use programs that capture +# or send raw packets. +# +# Change this as appropriate for your site, e.g. to make +# it owned by a particular user without changing the permissions, +# so only that user and the super-user can capture or send raw +# packets, or give it the permissions rw-r-----, so that +# only the super-user can send raw packets but anybody in the +# admin group can capture packets. +# - # Pre-create BPF devices. Set to 0 to disable. - FORCE_CREATE_BPF_MAX=256 +# Pre-create BPF devices. Set to 0 to disable. +FORCE_CREATE_BPF_MAX=256 - SYSCTL_MAX=$( sysctl -n debug.bpf_maxdevices ) - if [ "$FORCE_CREATE_BPF_MAX" -gt "$SYSCTL_MAX" ] ; then - FORCE_CREATE_BPF_MAX=$SYSCTL_MAX - fi +SYSCTL_MAX=$( sysctl -n debug.bpf_maxdevices ) +if [ "$FORCE_CREATE_BPF_MAX" -gt "$SYSCTL_MAX" ] ; then + FORCE_CREATE_BPF_MAX=$SYSCTL_MAX +fi - syslog -s -l notice "ChmodBPF: Forcing creation and setting permissions for /dev/bpf*" - - CUR_DEV=0 - while [ "$CUR_DEV" -lt "$FORCE_CREATE_BPF_MAX" ] ; do - # Try to do the minimum necessary to trigger the next device. - read -n 0 < /dev/bpf$CUR_DEV > /dev/null 2>&1 - CUR_DEV=$(( $CUR_DEV + 1 )) - done +syslog -s -l notice "ChmodBPF: Forcing creation and setting permissions for /dev/bpf*" + +CUR_DEV=0 +while [ "$CUR_DEV" -lt "$FORCE_CREATE_BPF_MAX" ] ; do + # Try to do the minimum necessary to trigger the next device. + read -n 0 < /dev/bpf$CUR_DEV > /dev/null 2>&1 + CUR_DEV=$(( $CUR_DEV + 1 )) +done - chgrp access_bpf /dev/bpf* - chmod g+rw /dev/bpf* -} - -StopService () -{ - return 0; -} - -RestartService () { StartService; } - -RunService "$1" +chgrp access_bpf /dev/bpf* +chmod g+rw /dev/bpf* diff --git a/packaging/macosx/ChmodBPF/README.macosx b/packaging/macosx/ChmodBPF/README.macosx deleted file mode 100644 index bf78eb5956..0000000000 --- a/packaging/macosx/ChmodBPF/README.macosx +++ /dev/null @@ -1,48 +0,0 @@ -As with other systems using BPF, Mac OS X allows users with read access -to the BPF devices to capture packets with libpcap and allows users with -write access to the BPF devices to send packets with libpcap. - -On some systems that use BPF, the BPF devices live on the root file -system, and the permissions and/or ownership on those devices can be -changed to give users other than root permission to read or write those -devices. - -On newer versions of FreeBSD, the BPF devices live on devfs, and devfs -can be configured to set the permissions and/or ownership of those -devices to give users other than root permission to read or write those -devices. - -On Mac OS X, the BPF devices live on devfs, but the OS X version of -devfs is based on an older (non-default) FreeBSD devfs, and that version -of devfs cannot be configured to set the permissions and/or ownership of -those devices. - -Therefore, we supply a "startup item" for OS X that will change the -ownership of the BPF devices so that the "admin" group owns them, and -will change the permission of the BPF devices to rw-rw----, so that all -users in the "admin" group - i.e., all users with "Allow user to -administer this computer" turned on - have both read and write access to -them. - -The startup item is in the ChmodBPF directory in the source tree. A -/Library/StartupItems directory should be created if it doesn't already -exist, and the ChmodBPF directory should be copied to the -/Library/StartupItems directory (copy the entire directory, so that -there's a /Library/StartupItems/ChmodBPF directory, containing all the -files in the source tree's ChmodBPF directory; don't copy the individual -items in that directory to /Library/StartupItems). - -If you want to give a particular user permission to access the BPF -devices, rather than giving all administrative users permission to -access them, you can have the ChmodBPF/ChmodBPF script change the -ownership of /dev/bpf* without changing the permissions. If you want to -give a particular user permission to read and write the BPF devices and -give the administrative users permission to read but not write the BPF -devices, you can have the script change the owner to that user, the -group to "admin", and the permissions to rw-r-----. Other possibilities -are left as an exercise for the reader. - -(NOTE: due to a bug in Snow Leopard, if you change the permissions not -to grant write permission to everybody who should be allowed to capture -traffic, non-root users who cannot open the BPF devices for writing will -not be able to capture outgoing packets.) diff --git a/packaging/macosx/ChmodBPF/StartupParameters.plist b/packaging/macosx/ChmodBPF/StartupParameters.plist deleted file mode 100644 index cba21664fe..0000000000 --- a/packaging/macosx/ChmodBPF/StartupParameters.plist +++ /dev/null @@ -1,4 +0,0 @@ -{ - Description = "Change BPF permissions"; - Provides = ("ChmodBPF"); -} diff --git a/packaging/macosx/ChmodBPF/org.wireshark.ChmodBPF.plist b/packaging/macosx/ChmodBPF/org.wireshark.ChmodBPF.plist new file mode 100644 index 0000000000..30375de585 --- /dev/null +++ b/packaging/macosx/ChmodBPF/org.wireshark.ChmodBPF.plist @@ -0,0 +1,12 @@ + + + + + Label + org.wireshark.ChmodBPF + RunAtLoad + + Program + /Library/Application Support/Wireshark/ChmodBPF/ChmodBPF + + diff --git a/packaging/macosx/Makefile.am b/packaging/macosx/Makefile.am index 0889ee2431..8291b85114 100644 --- a/packaging/macosx/Makefile.am +++ b/packaging/macosx/Makefile.am @@ -13,8 +13,7 @@ MAINTAINERCLEANFILES = \ EXTRA_DIST = \ ChmodBPF/ChmodBPF \ - ChmodBPF/README.macosx \ - ChmodBPF/StartupParameters.plist \ + ChmodBPF/org.wireshark.ChmodBPF.plist \ dmg_background.png \ dmg_background.svg \ util_background.png \ diff --git a/packaging/macosx/Read_me_first_gtk.rtf b/packaging/macosx/Read_me_first_gtk.rtf index 85ed70d5ed..73503c9524 100644 --- a/packaging/macosx/Read_me_first_gtk.rtf +++ b/packaging/macosx/Read_me_first_gtk.rtf @@ -1,4 +1,4 @@ -{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390 +{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf400 \cocoascreenfonts1{\fonttbl\f0\froman\fcharset0 TimesNewRomanPSMT;\f1\fswiss\fcharset0 Helvetica;\f2\fnil\fcharset0 Menlo-Regular; } {\colortbl;\red255\green255\blue255;} @@ -11,7 +11,8 @@ \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural \f0\b\fs28 \cf0 Before You Begin\ -\ +\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural +\cf0 \ \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural \f1\b0\fs24 \cf0 This release of Wireshark requires Macintosh OS X 10.5.5 or later, including X11.app. If you are running OS X 10.5.4 or older you can install using another packaging system such as MacPorts or Homebrew. @@ -38,14 +39,17 @@ Quick Setup\ \ \pard\tx220\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\li720\fi-720\pardirnatural \ls2\ilvl0\cf0 {\listtext \'95 } -\i /Applications/Wireshark +\i /Applications/Wireshark.app \i0 . The main Wireshark application.\ {\listtext \'95 } -\i /Library/StartupItems/ChmodBPF -\i0 . A script which adjusts permissions on the system's packet capture devices ( +\i /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist +\i0 . A launch daemon that adjusts permissions on the system's packet capture devices ( \i /dev/bpf \i0 *) when the system starts up.\ {\listtext \'95 } +\i /Library/Application Support/Wireshark/ChmodBPF +\i0 A copy of the launch daemon property list, and the script that the launch daemon runs.\ +{\listtext \'95 } \i /usr/local/bin \i0 . A wrapper script and symbolic links which will let you run Wireshark and its associated utilities from the command line. You can access them directly or by adding /usr/local/bin to your PATH if it's not already in your PATH.\ \pard\tx560\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural @@ -63,15 +67,21 @@ Additionally a group named \pard\tx220\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\li720\fi-720\pardirnatural \ls3\ilvl0 \f1 \cf0 {\listtext 1. }Remove -\i /Applications/Wireshark +\i /Applications/Wireshark.app \i0 \ -{\listtext 2. }Remove the wrapper scripts from -\i /usr/local/bin +{\listtext 2. }Remove +\i /Library/Application Support/Wireshark \i0 \ -{\listtext 3. }Remove -\i /Library/StartupItems/ChmodBPF +{\listtext 3. }Remove the wrapper scripts from +\i /usr/local/bin\ +\ls3\ilvl0 +\i0 {\listtext 4. }Unload the +\i org.wireshark.ChmodBPF.plist +\i0 launchd job\ +{\listtext 5. }Remove +\i /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist \i0 \ -{\listtext 4. }Remove the +{\listtext 6. }Remove the \i access_bpf \i0 group.\ \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural diff --git a/packaging/macosx/Read_me_first_qt.rtf b/packaging/macosx/Read_me_first_qt.rtf index 2cecb41d50..391784452f 100644 --- a/packaging/macosx/Read_me_first_qt.rtf +++ b/packaging/macosx/Read_me_first_qt.rtf @@ -1,4 +1,4 @@ -{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf390 +{\rtf1\ansi\ansicpg1252\cocoartf1187\cocoasubrtf400 \cocoascreenfonts1{\fonttbl\f0\froman\fcharset0 TimesNewRomanPSMT;\f1\fswiss\fcharset0 Helvetica;\f2\fnil\fcharset0 Menlo-Regular; } {\colortbl;\red255\green255\blue255;} @@ -38,14 +38,17 @@ Quick Setup\ \ \pard\tx220\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\li720\fi-720\pardirnatural \ls2\ilvl0\cf0 {\listtext \'95 } -\i /Applications/Wireshark +\i /Applications/Wireshark.app \i0 . The main Wireshark application.\ {\listtext \'95 } -\i /Library/StartupItems/ChmodBPF -\i0 . A script which adjusts permissions on the system's packet capture devices ( +\i /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist +\i0 . A launch daemon that adjusts permissions on the system's packet capture devices ( \i /dev/bpf \i0 *) when the system starts up.\ {\listtext \'95 } +\i /Library/Application Support/Wireshark/ChmodBPF +\i0 A copy of the launch daemon property list, and the script that the launch daemon runs.\ +{\listtext \'95 } \i /usr/local/bin \i0 . A wrapper script and symbolic links which will let you run Wireshark and its associated utilities from the command line. You can access them directly or by adding /usr/local/bin to your PATH if it's not already in your PATH.\ \pard\tx560\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural @@ -63,15 +66,21 @@ Additionally a group named \pard\tx220\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\li720\fi-720\pardirnatural \ls3\ilvl0 \f1 \cf0 {\listtext 1. }Remove -\i /Applications/Wireshark +\i /Applications/Wireshark.app +\i0 \ +{\listtext 2. }Remove +\i /Library/Application Support/Wireshark \i0 \ -{\listtext 2. }Remove the wrapper scripts from +{\listtext 3. }Remove the wrapper scripts from \i /usr/local/bin \i0 \ -{\listtext 3. }Remove -\i /Library/StartupItems/ChmodBPF +{\listtext 4. }Unload the +\i org.wireshark.ChmodBPF.plist +\i0 launchd job\ +{\listtext 5. }Remove +\i /Library/LaunchDaemons/org.wireshark.ChmodBPF.plist \i0 \ -{\listtext 4. }Remove the +{\listtext 6. }Remove the \i access_bpf \i0 group.\ \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural diff --git a/packaging/macosx/Scripts/chmodbpf-postinstall.sh b/packaging/macosx/Scripts/chmodbpf-postinstall.sh index d0cd33d8eb..cbd2f08f12 100755 --- a/packaging/macosx/Scripts/chmodbpf-postinstall.sh +++ b/packaging/macosx/Scripts/chmodbpf-postinstall.sh @@ -1,7 +1,6 @@ #!/bin/sh -CHMOD_BPF_DIR="/Library/StartupItems/ChmodBPF" -CHMOD_BPF="$CHMOD_BPF_DIR/ChmodBPF" +CHMOD_BPF="/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist" BPF_GROUP="access_bpf" BPF_GROUP_NAME="BPF device access ACL" @@ -9,6 +8,9 @@ dscl . -read /Groups/"$BPF_GROUP" > /dev/null 2>&1 || \ dseditgroup -q -o create "$BPF_GROUP" dseditgroup -q -o edit -a "$USER" -t user "$BPF_GROUP" -chmod -R go-w "$CHMOD_BPF_DIR" +cp "/Library/Application Support/Wireshark/ChmodBPF/org.wireshark.ChmodBPF.plist" \ + "$CHMOD_BPF" +chmod 755 "$CHMOD_BPF" +chown root:wheel "$CHMOD_BPF" -sh "$CHMOD_BPF" start +launchctl load "$CHMOD_BPF" diff --git a/packaging/macosx/Wireshark_package.pmdoc/02chmodbpf.xml b/packaging/macosx/Wireshark_package.pmdoc/02chmodbpf.xml index c795f60f9a..449030b0aa 100644 --- a/packaging/macosx/Wireshark_package.pmdoc/02chmodbpf.xml +++ b/packaging/macosx/Wireshark_package.pmdoc/02chmodbpf.xml @@ -1 +1 @@ -org.wireshark.ChmodBPF.pkg1.0ChmodBPF/Library/StartupItemsinstallToscripts.postinstall.pathincludeRootinstallFrom.isRelativeTypeversionparentscripts.scriptsDirectoryPath.pathrequireAuthorizationidentifierextraFilesinstallTo.pathpostInstallScripts/chmodbpf-postinstall.shScripts \ No newline at end of file +org.wireshark.ChmodBPF.pkg1.0ChmodBPF/Library/Application Support/WiresharkinstallToscripts.postinstall.pathincludeRootinstallFrom.isRelativeTypeversionparentscripts.scriptsDirectoryPath.pathrequireAuthorizationidentifierextraFilesinstallTo.pathpostInstallScripts/chmodbpf-postinstall.shScripts diff --git a/packaging/macosx/Wireshark_package.pmdoc/index.xml.in b/packaging/macosx/Wireshark_package.pmdoc/index.xml.in index ba2f8a6125..9c2960c910 100644 --- a/packaging/macosx/Wireshark_package.pmdoc/index.xml.in +++ b/packaging/macosx/Wireshark_package.pmdoc/index.xml.in @@ -1 +1 @@ -WiresharkWireshark.pkgorg.wiresharkWireshark (requires X11) and associated command line utilities.COPYING.txtFailureThis package requires Mac OS X @OSX_MIN_VERSION@ or later. If you cannot upgrade you might try installing using MacPorts or Fink.01wireshark.xml02chmodbpf.xml03utility.xmldescriptionproperties.titleproperties.anywhereDomainproperties.userDomainproperties.customizeOptionextraFilespostinstallActions.actionsproperties.systemDomain +WiresharkWireshark.pkgorg.wiresharkWireshark (requires X11) and associated command line utilities.COPYING.txtFailureThis package requires Mac OS X @OSX_MIN_VERSION@ or later. If you cannot upgrade you might try installing using MacPorts or Fink.01wireshark.xml02chmodbpf.xml03utility.xmldescriptionproperties.titleproperties.anywhereDomainproperties.userDomainproperties.customizeOptionextraFilespostinstallActions.actionsproperties.systemDomain -- cgit v1.2.3