Macos File System Security

macOS File System & Security Reference

This skill provides comprehensive guidance on macOS file systems, permissions, binaries, and security mechanisms for security researchers, pentesters, and system administrators.

File Hierarchy Layout

Root Directory Structure

Applications Folders

• System applications: /System/Applications
• Installed applications: /Applications or ~/Applications
• Application data (root): /Library/Application Support
• Application data (user): ~/Library/Application Support
• Privileged helper tools: /Library/PrivilegedHelperTools/ (root daemons)
• Sandboxed apps: ~/Library/Containers/ (named by bundle ID, e.g., com.apple.Safari)
• Kernel: /System/Library/Kernels/kernel
• Apple kernel extensions: /System/Library/Extensions
• Third-party kernel extensions: /Library/Extensions

macOS-Specific File Extensions

Reading Plist Files

# Read binary plist
defaults read config.plist

# PlistBuddy
/usr/libexec/PlistBuddy -c print config.plist

# plutil (print as XML)
plutil -p ~/Library/Preferences/com.apple.screensaver.plist

# Convert to XML
plutil -convert xml1 ~/Library/Preferences/com.apple.screensaver.plist -o -

# Convert to JSON
plutil -convert json ~/Library/Preferences/com.apple.screensaver.plist -o -

File Permissions & Flags

Folder Permissions

• Read: List directory contents
• Write: Delete and create files
• Execute: Traverse directory

Note: A user with read permission on a file inside a directory where they lack execute permission cannot read the file.

File Flags

Check flags with: ls -lO /path/directory

Complete Flag Reference

From sys/stat.h:

Owner-settable flags (UF_SETTABLE 0x0000ffff):

• UF_NODUMP (0x00000001): Do not dump file
• UF_IMMUTABLE (0x00000002): File may not be changed
• UF_APPEND (0x00000004): Writes may only append
• UF_OPAQUE (0x00000008): Directory opaque wrt union
• UF_COMPRESSED (0x00000020): File is compressed
• UF_TRACKED (0x00000040): No notifications for deletes/renames
• UF_DATAVAULT (0x00000080): Entitlement required for read/write
• UF_HIDDEN (0x00008000): Hint to hide from GUI

Superuser flags (SF_SETTABLE 0x3fff0000):

• SF_ARCHIVED (0x00010000): File is archived
• SF_IMMUTABLE (0x00020000): File may not be changed
• SF_APPEND (0x00040000): Writes may only append
• SF_RESTRICTED (0x00080000): Entitlement required for writing
• SF_NOUNLINK (0x00100000): Item may not be removed/renamed
• SF_FIRMLINK (0x00800000): File is a firmlink
• SF_DATALESS (0x40000000): File is dataless object

File ACLs (Access Control Lists)

Files with ACLs show a + in permissions: drwx------+

Directory ACEs

• list, search, add_file, add_subdirectory, delete_child

File ACEs

• read, write, append, execute

ACL Commands

# Read ACLs
ls -lde Movies

# Find all files with ACLs (slow)
ls -RAle / 2>/dev/null | grep -E -B1 "\d: "

Extended Attributes

View with: ls -@ or xattr -l <file>

Common Extended Attributes

Resource Forks (macOS ADS)

# Create resource fork
echo "Hello" > a.txt
echo "Hello Mac ADS" > a.txt/..namedfork/rsrc

# Read extended attributes
xattr -l a.txt

# Find files with resource forks
find / -type f -exec ls -ld {} \; 2>/dev/null | grep -E "[x\-]@ " | awk '{printf $9; printf "\n"}' | xargs -I {} xattr -lv {} | grep "com.apple.ResourceFork"

decmpfs (Compressed Files)

Files with com.apple.decmpfs attribute:

• ls -l reports size of 0
• Data stored in extended attribute
• Decrypted in memory on access
• Flagged with UF_COMPRESSED (visible via ls -lO)

# Remove compressed flag (breaks decompression)
chflags nocompressed </path/to/file>

# Force decompress
afscexpand <file>

Dyld Shared Library Cache (SLC)

All system shared libraries combined into a single file for performance.

Locations

• macOS: /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/
• Older macOS: /System/Library/dyld/
• iOS: /System/Library/Caches/com.apple.dyld/

Extraction Tools

# dyld_shared_cache_util
dyld_shared_cache_util -extract ~/shared_cache/ /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e

# dyldextractor
dyldex -l [dyld_shared_cache_path]  # List libraries
dyldex_all [dyld_shared_cache_path]  # Extract all

Override SLCs

# Load custom shared library cache
DYLD_SHARED_REGION=private DYLD_SHARED_CACHE_DIR=</path/dir> DYLD_SHARED_CACHE_DONT_VALIDATE=1

# Avoid shared cache (use individual libraries)
DYLD_SHARED_CACHE_DIR=avoid

SLC Mapping

• shared_region_check_np: Check if SLC mapped (returns address)
• shared_region_map_and_slide_np: Map the SLC
• All processes use the same copy (ASLR implications)

Universal Binaries & Mach-O Format

Universal binaries support multiple architectures in one file. Use lipo to inspect:

# Show architectures
lipo -info binary

# Extract specific architecture
lipo -thin x86_64 -output binary_x86 binary

Important Configuration Locations

Note: Many paths under /System are SIP-protected and require SIP bypass to modify.

Log Files

Risk Category Files

Location: /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/System

Common Commands Reference

# Find stat.h for flag definitions
mdfind stat.h | grep stat.h

# Check if syslogd is running
launchctl list | grep "com.apple.syslogd"

# Read plist
plutil -p <file.plist> -o -

# List extended attributes
xattr -l <file>

# Remove extended attribute
xattr -d <attribute> <file>

# Set file flag
chflags uchg <file>

# Remove file flag
chflags nouchg <file>

# List ACLs
ls -lde <file>

# Find files with ACLs
ls -RAle / 2>/dev/null | grep -E -B1 "\d: "

Security Considerations

1. SIP (System Integrity Protection): Protects /System and other critical directories. Many operations require SIP bypass.

2. Gatekeeper: Uses com.apple.quarantine extended attribute to track downloaded files.

3. Sandboxing: Apps in ~/Library/Containers/ are sandboxed with restricted access.

4. Kernel Extensions: Require signature validation and SIP considerations.

5. File Flags: uchg and restricted flags can prevent modification even by root (in some cases).

6. Shared Cache: All processes share the same SLC copy, which has ASLR implications.

When to Use This Skill

Use this skill when:

• Investigating macOS file systems for security research
• Understanding macOS permissions and ACLs
• Analyzing plist files and configuration
• Working with macOS binaries and Mach-O format
• Researching macOS security mechanisms (SIP, Gatekeeper, sandboxing)
• Finding sensitive configuration files
• Understanding extended attributes and resource forks
• Working with dyld shared cache
• Pentesting macOS systems
• System administration tasks involving macOS file structures