March 2008 – brunerd

What’s in the Time Machine Update?

March 20, 2008July 30, 2023 brunerd

Here’s the meat of what gets updated: backup daemon helper & file vault image tool, loginwindow.app, Broadcom and Aetheros wireless kexts. Lotsa System.kexts: BSD, IOKit, Libkern, MAC Framework, Mach. The AFP filesystem plugin, metadata framework, the backupd launch daemon plists, and the DiskImages framework.

/System/Library/CoreServices/SystemVersion.plist

/System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper

/System/Library/CoreServices/backupd.bundle/Contents/Resources/fvimagetool

/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow

/System/Library/Extensions/IO80211Family.kext/Contents/PlugIns/AirPortAtheros.kext/Contents/MacOS/AirPortAtheros

/System/Library/Extensions/IO80211Family.kext/Contents/PlugIns/AppleAirPortBrcm4311.kext/Contents/MacOS/AppleAirPortBrcm4311

/System/Library/Extensions

/System.kext/PlugIns/BSDKernel.kext/BSDKernel

/System/Library/Extensions

/System.kext/PlugIns/IOKit.kext/IOKit

/System/Library/Extensions

/System.kext/PlugIns/Libkern.kext/Libkern

/System/Library/Extensions

/System.kext/PlugIns/MACFramework.kext/MACFramework

/System/Library/Extensions

/System.kext/PlugIns/Mach.kext/Mach

/System/Library/Extensions

/System.kext/PlugIns

/System6.0.kext/kernel.6.0

/System/Library/Extensions

/System.kext/PlugIns/Unsupported.kext/Unsupported

/System/Library/Filesystems/AppleShare/afpfs.kext/Contents/MacOS/afpfs

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds

/System/Library/LaunchDaemons/com.apple.backupd-attach.plist

/System/Library/LaunchDaemons/com.apple.backupd-auto.plist

/System/Library/LaunchDaemons/com.apple.backupd-wake.plist

/System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages/usr/share/man/man1/tmdiagnose.1

Here’s hoping that the update in tandem with the Airport/Time Capsule fixes some of the problems people have had with using a hard drive as an Airport disk on the Airport Extremes. For me it wasn’t even about Time Machine, the real pain was transfers were SLOW even over the 100Mb/s Ethernet (dangit I jumped the gun and didn’t get the GigE model) and sometimes the Airport Disk couldn’t be mounted on my computers until the Airport was restarted. Also with the update the ever mysterious Wide Area Bonjour prefs are still around, they are in the Name-Edit… button now.One more thing…/usr/share/man/man1/tmdiagnose.1: Hmmm, is this a Time Machine diagnostics tool?Let’s have a look at the man page or this one:tmdiagnose(1) BSD General Commands Manual tmdiagnose(1)NAME tmdiagnose, Other_name_for_same_program(), Yet another name for the same program. — This line parsedfor whatis database.

tmdiagnose(1) BSD General Commands Manual tmdiagnose(1)

NAME

   tmdiagnose, Other_name_for_same_program(), Yet another name for the same program. — This line parsed

   for whatis database.

SYNOPSIS

   tmdiagnose, [-abcd] [-a path] [file] [file …] arg0 arg2 …

DESCRIPTION

   Use the .Nm macro to refer to your program throughout the man page like such: tmdiagnose, Underlining

   is accomplished with the .Ar macro like this: underlined text.

   A list of items with descriptions:

   item a Description of item a

   item b Description of item b

   A list of flags and their descriptions:

   -a Description of -a flag

   -b Description of -b flag

FILES

   /usr/share/file_name FILE_1 description

   /Users/joeuser/Library/really_long_file_name FILE_2 description

SEE ALSO

   a(1), b(1), c(1), a(2), b(2), a(3), b(3)

Darwin April 2, 2008 Darwin

Only a dummy man page. And no executable to be found. Its origins though are from the BSD package (see /Library/Receipts/boms/com.apple.pkg.BSD.bom) No change has been made to this man page since 10.5 but yet it is included with this update? Odd. My guess is that there is an Apple internal tool in use but not something for the general public. I mean why would the ‘Rest of Us’ need to diagnose Time Machine?!It’ just works right? ;)

Office 2008 fonts

March 12, 2008November 24, 2008 brunerd

A postscript to fonts (hehe), I wanted to mention how Office 2008 will replace your Apple supplied fonts with Microsoft fonts, placing them in /Library/Fonts Disabled. Well I like my Apple fonts just fine thank you, so for posterity here’s a list of the fonts that get bumped:

Tiger and Leopard Conflicts:

Andale Mono
Arial
Arial Black
Arial Narrow
Arial Rounded Bold
Brush Script
Comic Sans MS
Georgia
Impact
Times New Roman
Trebuchet MS
Verdana

Leopard Only Conflicts:

Tahoma
Wingdings 2
Wingdings 3

Also, just so you know there is set of fonts that Microsoft calls it’s ClearType Font Collection these fonts can be found on Vista and Windows Office 2007 (and Office 2008) they are:

Calibri Bold Italic.ttf
Calibri Bold.ttf
Calibri Italic.ttf
Calibri.ttf
Cambria Bold Italic.ttf
Cambria Bold.ttf
Cambria Italic.ttf
Cambria.ttf
Candara Bold Italic.ttf
Candara Bold.ttf
Candara Italic.ttf
Candara.ttf
Consolas Bold Italic.ttf
Consolas Bold.ttf
Consolas Italic.ttf
Consolas.ttf
Constantia Bold Italic.ttf
Constantia Bold.ttf
Constantia Italic.ttf
Constantia.ttf
Corbel Bold Italic.ttf
Corbel Bold.ttf
Corbel Italic.ttf
Corbel.ttf

All named C, like when parents name all there kids by the same letter, which is a bizarre practice I’ve never understood. I have yet to do more testing, but in an attempt to find out what the bare minimum fonts required are this seems like a good place to start.

And what the hey, here’s the rest of the Office 2008 fonts minus the conflicts and the ClearType Collection:

Abadi MT Condensed Extra Bold
Abadi MT Condensed Light
Baskerville Old Face
Batang.ttf
Bauhaus 93
Bell MT
Bernard MT Condensed
Book Antiqua
Bookman Old Style
Bookshelf Symbol 7.ttf
Braggadocio
Britannic Bold
Calisto MT
Century
Century Gothic
Century Schoolbook
Colonna
Cooper Black
Copperplate Gothic Bold
Copperplate Gothic Light
Curlz MT
Desdemona
Edwardian Script ITC
Engravers MT
Eurostile
Footlight Light
Franklin Gothic Book Italic.ttf
Franklin Gothic Book.ttf
Franklin Gothic Medium Italic.ttf
Franklin Gothic Medium.ttf
Garamond
Gill Sans MT Bold Italic.ttf
Gill Sans MT Bold.ttf
Gill Sans MT Italic.ttf
Gill Sans MT.ttf
Gill Sans Ultra Bold
Gloucester MT Extra Condensed
Goudy Old Style
Gulim.ttf
Haettenschweiler
Harrington
Imprint MT Shadow
Kino
Lucida Blackletter
Lucida Bright
Lucida Calligraphy
Lucida Console.ttf
Lucida Fax
Lucida Handwriting
Lucida Sans
Lucida Sans Typewriter
Lucida Sans Unicode.ttf
Marlett.ttf
Matura Script Capitals
Meiryo Bold Italic.ttf
Meiryo Bold.ttf
Meiryo Italic.ttf
Meiryo.ttf
Mistral
Modern No. 20
Monotype Corsiva
Monotype Sorts
MS Gothic.ttf
MS Mincho.ttf
MS PGothic.ttf
MS PMincho.ttf
MS Reference Sans Serif.ttf
MS Reference Specialty.ttf
MT Extra
News Gothic MT
Onyx
Perpetua Bold Italic.ttf
Perpetua Bold.ttf
Perpetua Italic.ttf
Perpetua Titling MT
Perpetua.ttf
Playbill
PMingLiU.ttf
Rockwell
Rockwell Extra Bold
SimSun.ttf
Stencil
Tw Cen MT Bold Italic.ttf
Tw Cen MT Bold.ttf
Tw Cen MT Italic.ttf
Tw Cen MT.ttf
Wide Latin
Wingdings

Office 2008 12.01 Update almost does it

March 12, 2008March 13, 2008 brunerd

So the Office 2008 12.01 updater came out, it’s got a whole lot of packages for each app and component with postflight scripts written in Python to clean up all the permissions:

Mar 12 15:33:00 brunerd runner[8556]: postflight[8773]: setting ownership/permissions
Mar 12 15:33:00 brunerd runner[8556]: postflight[8773]: fixing setuid flags
Mar 12 15:33:00 brunerd runner[8556]: postflight[8773]: clearing ACLs
Mar 12 15:33:00 brunerd runner[8556]: postflight[8773]: sanitizing receipts

Doing an ls -lRFG in /Applications/Microsoft Office 2008 won’t leave you seeing red, they’ve cleaned that all up quite nicely.

Anyway, call me picky, but it forgets just one thing, the /Library/Fonts/Microsoft folder, it leaves that and its contents owned by 502 and they’re all marked executable. (Fonts don’t really need to be executable.) And as paranoid as it is — it’s still not quite right. So after you’ve put your tinfoil hat on, run 12.01, you can do this to finish it up:

#take away all users’ execute permissions
chmod a-x /Library/Fonts/Microsoft/*
#recursively own all fonts as root and admin group
sudo chown -R root:admin /Library/Fonts/Microsoft

Update: Or you can go into the update using Show Package Contents then navigate to Contents/Packages and run Office2008_en_fonts_12.0.1.incremental.pkg again, that’ll do the trick.

Applescript Language Guide for Leopard Released (Finally)

March 11, 2008March 11, 2008 brunerd 1 Comment

So just today I was this close to going on the Applescript mailing list to find out why the Apple Script Language guide for Leopard had yet to be released, despite being touted as “the essential guide for scripters and developers” on the Apple website, the old version from 1999 was all that could be found since Leopard’s release last year.

But today, with as little fanfare as possible, it was released.

Now go forth and…

tell Safari
get all documents containing “Applescript 2.0”
end tell

ARD Security Awareness (Standard User can run root commands)

March 8, 2008March 8, 2008 brunerd

Did you know a Standard user can run commands as root via ARD?
This seems really odd doesn’t it? Why would this be necessary? The thing that gets me is how in Tiger you had to explicitly grant each user the privileges after starting the ARD service. But in Leopard, when you start the service All Users is the default.

So let’s take a walkthrough of what I was looking into this Friday evening:
Find a Mac running Leopard
Turn on Remote Management (yes you do have to be admin to do this)
Notice the default is for All Users to have access.
Create a Standard user in Leopard
Great, now go get a machine with ARD on it.
Add the computer to your ARD list using the standard user’s credentials
Send it a Unix Command to run as root (touch /HaxorWasHere, in this case)
Notice the new file owned by root in a place where no standard user can put things.

Interestingly, perhaps because I had done this a number of times, and Leopard got confused after a while, I tried deleting through Finder (while logged in as ‘test’ but authenticating as administrator) and got this message

OK that oddity aside, here’s another: You don’t need to have everything checked in ARD’s preferences to accomplish this, here’s the bare minimum :

Generate reports

Open and quit applications

Change settings

Delete and replace items

Restart and shut down

Copy items

Page 66 of the ARD manual does go into detail what needs to be turned on to run a Unix command, but why not just have a check box: Run Unix Command? Also, Generate Reports isn’t listed as one of them, but unless it was checked I got this?

Now I’m not saying this is an out and out security breach, no, because it requires admin privileges to turn on the service and add the user, but it does show how simply checking a check box as an admin could open your up your Mac to Bad Things™ if a standard user on your family computer has a weak password and someone else has ARD in a dark alley… well, you know what I mean. This just doesn’t seem right. Standard users should only be able to do standard user things, even in the magical world of ARD.

See the ARD manual pages 65-68 for Apple’s wording on the Remote Management Preference pane permissions. See if it seems clear that Standard users given ‘administrator’ (ARD administrator in this case) privileges can run as root. Leave a comment and let me know what you think, thanks.