Mac Geekery

Can i install my Leopard OS onto my PC?

Yes. The current solution is to use a piece of software called simply “PC-EFI” that emulates a Mac firmware environment. There’s some instructions out there already for how to get this done.

Hello, I am looking for information regarding how to boot a iBook,G4, with linux on a USB flash drive…

You cannot boot a G4 iBook from a USB drive of any kind — only FireWire or internal drives.

On my iBook G4 14’ when I run openSUSE 10.3 I noticed (for some time now) the white led blinks when the hard drive is accessed.There's more »

One of the great dillemas of Mac admins is how to give users the ability to actually USE their machines, without the monkeys gumming up the works constantly. One of the easiest ways to do this is by using Open Directory. But what if you don’t have an Open Directory server?

Create a Power Users group. It gives users the ability to install the applications they want, without letting them modify things like network settings.

Working off of this tip from Mac OS X Hints, I created this method:There's more »

1. Download the server tools, and put Workgroup Manager either local on your machine or on an external drive (I use my Shuffle)
2. Open Workgroup Manager and edit the local directory

I have some backup drives at home on my server that nightly mirror other drives’ information incase I do something stupid to them. It occurred to me that, over time, the constant mirroring would leave digital trash all around those drives that I probably wouldn’t want just lying around. I rather like the idea of a deleted file being gone and all that.

So I remembered that Disk Utility has a freespace erasure button in it, but I didn’t want to have to go do that every time I wanted to clean up after myself. So I poked at the CLI version of the program and, lo, it has the option there. So at the end of my backup scripts I’m now running something like the following for each of the drives involved (the script runs as root):There's more »

diskutil secureErase freespace 1 /Volumes/Backup1

It comes up often enough that being an admin on your computer is a dangerous affair and that the recommended way to handle it is to not be an admin. When I mention this to people, they seem to get the impression that the first slot, the user with the ID 501, must be an admin. As such, they lament about moving files to a different account and ownership issues and all kinds of silly crap associated with some big fiasco of moving accounts around like I was telling them to change their account short name the long way or something.

It’s much easier than you think, if you’re of that mindset.There's more »

There exists a pretty significant interface problem with the Apple Installer program such that any package requesting admin access via the AdminAuthorization key, when run in an admin user account, is given full root-level access without providing the user with a password prompt during the install. This is even explained in Apple’s Installer documentation as proper behavior. The distinction between the AdminAuthorization and RootAuthorization keys is, simply, whether or not the admin user is prompted for a password; the end powers are exactly the same and it is up to the creator of the package as to if he will be kind enough to ask for a password.

By creating a malicious package and setting the authorization level to AdminAuthorization in the package, an attacker can modify root-owned files, execute commands as root, or install setuid-root programs without alerting the user that such actions are taking place. The problem is compounded when you consider that over 90% of Mac OS X users run as the administrator user because it’s what the default user created by the system is.

A secondary problem is that even packages that have been created with the RootAuthorization key as a precaution can be modified afterwards to use AdminAuthorization and can then be installed without the administrator’s password if the account has been left logged in.

How and Why

When a user opens an installer package set to require administrative privileges to install, Installer will check and see if the current user is an administer of the computer. If so, the Installer program will run the entire install process, including any pre- and post-flight scripts/programs as the root user without prompting the user for the administrator account’s password.

By using this method, an individual could open a properly-formed Installer package and open themselves up to attack. Similarly, an individual could sit down at any logged-in station and circumvent local password requirements for creating a new account by using a script in the package to create the account, even if the user is using the option in the Security preferences to lock System Preferences when first opened in order to prevent such behavior as this comes in from another angle entirely.There's more »