Michael Tsai
Gwynne Raskind
@mjtsai Also notice that the EA mentioned by Dave Nanian is, at least conceptually, just a reimplementation of chflags(SF_IMMUTABLE);
System Integrity Protection (a.k.a. Rootless): http://mjtsai.com/blog/2015/07/12/system-integrity-protection-a-k-a-rootless/ …
-
-
-
@ameaijou So the difference is just who is allowed to set the flag/xattr? -
@mjtsai Yeah. chflags() can only unset SF_* in single-user mode, whereas the EA appears to be gated by entitlements. The result is the same. -
- View other replies
-
@landonfuller@mjtsai That’s what inspired a new impl in the first place: Local admin control is assumed to be too stupid to be safe. -
@landonfuller@mjtsai Unfortunately, in a lot of cases it’s a legit assumption. Many users don’t know what an admin password even is. -
@landonfuller@mjtsai That being said, those same users have no clue how to go to single-user mode so... - Show more
-
Landon Fuller
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.