mercredi 7 janvier 2015

warning / tracking kext installs - managing security with kext-signing disabled


The goal is to track when kexts are installed and determine whence kexts came. For instance TRIM is disabled for 3rd party drives in OS X Yosemite. To use a utility like Trim Enabler one must disable kext signing globally. WRT to http://ift.tt/1vUIizO – specifically:


“It is important to note that the kext-signing setting is global, if you disable it you should be careful to only install system drivers from sources that you trust.”


It occurs this would be a manageable security issue if one can track kext installed when kext signing is turned off. However, 1/ I don’t know how to discern whether/when kexts are being installed, or 2/ who wrote the kexts already in /System/Library/Extensions/ from before, or 3/ if I miss an alert, how to determine after the fact.


1/ Is there some way to get an alert, warning when a kext is being installed? 2/ Is there some way to determine which program installed the kexts already there?





Aucun commentaire:

Enregistrer un commentaire