hardening time machine user files

bmike

Mar 8, 2016 19:08

0

Time Machine backups are primarily protected by ACL denying permission for anyone to write to a file. $ ls -le /Volumes/Whatever/Backups.backupdb/Mac/Latest/Macintosh\ HD/Users/me/Desktop/file.text -rw-r--r--@ 1 me staff - 14 Mar 8 11:54 /Volumes/Whatever/Backups.backupdb/Mac/Latest/Macint...

Phillip - work with a sample file on your user desktop.

Hi @Philipp

Philipp

Hi Mike. You want me to create a file on my Desktop and work with that? I don't have backups.backupdb directory because its only networked.

bmike

normal users don't get to mess with things outside their home folder - here's some commands to get things kickstarted for your investigations (which I welcome : )

echo "Ask Different" >> foo.text
tmutil startbackup

then wait a bit for the network to mount.

tmutil status will show you once copying has started.

then you can change into the directory to keep in mounted.

Philipp

Just for your background information. I used to administor linux webservers, so I know my way around in bash. Just so that you can adjust your level of verbosity :-)

bmike

Awesome. So I'll just paint the OS X edges :-)

Philipp

I am doing all this with my Administrator account, yes?

bmike

Mar 8, 2016 19:12

It doesn't matter. I tested with an admin account and a non admin account.

Philipp

tmutil status says BackupPhase = MountingBackupVol; … "Running=1",

bmike

perfect - the tmutil man page will get you some details if needed.

tmutil compare is also useful to get the filesystem mounted for a while churning

Philipp

Is it normal that it takes so long in the Mounting state?

bmike

60 seconds is not unusual. Are you Time Capsule - might be slower. OS X server - generally faster. SAN/NAS/DIY - it varies

Philipp

Hmm, it's TC. Now its in "Starting"

bmike

Mar 8, 2016 19:15

once df shows it mounted you're in business to cd to the machine directory or better snapshot itself.

Philipp

ok its in df

two shares

bmike

Also - latest gets linked at the end of the backup - you can't use that path to get to the file until later.

Philipp

one /Volumes/MyBackup

and one /Volume/Time Machine Backups

in which should I cd?

bmike

"Time Machine Backups" is the mounted sparse bundle. That's where to work..

Philipp

ok that works

bmike

Mar 8, 2016 19:16

the other is the actual share point on which the sparse bundle sits. those files are protected well/better (IMO).

Again - I really appreciate you checking my work. I'd hate to be wrong

Philipp

I am in

bmike

Good - your shell will prevent the dismount of the filesystem since it keeps a file open in the hierarchy

Philipp

That's already a step that shouldn't be possible, to see all these files :-(

bmike

when you're all done - exit that shell and kick off another backup.

yup - anyone can read about anything

Philipp

I cd'ed to the Desktop dir, but the file is not there yet

But it's in Copying mode now

bmike

Mar 8, 2016 19:19

it won't be there - initially the backup goes to an .inProgress structure and then gets finalized

Philipp

but it doesn't matter, I can try to change the ACL of another file

bmike

drwxr-xr-x@  3 root  wheel   204 Mar  8 12:49 2016-03-08-124934
drwxr-xr-x@  3 root  wheel   204 Mar  8 13:11 2016-03-08-131148
drwxr-xr-x@  3 root  wheel   136 Mar  8 13:18 2016-03-08-131844.inProgress
lrwxr-xr-x   1 root  wheel    17 Mar  8 13:11 Latest -> 2016-03-08-131148

Yes - you can mess with anything now.

Philipp

Ok, I can confirm that I can change ACL and delete files

bmike

just needs to be in deep enough past the machine root

Philipp

Bad

bmike

Mar 8, 2016 19:21

:-)

and I smile sarcastically - it's bad for "securing" the files once backed up

Philipp

What I don't understand is why this needs to be possible. It seems to me that an architecture would be easily possible that allows only root to change files in the sparsebundle.

bmike

anything the OS can set - someone with minimal knowledge can undo. Whether it's an immutable flag, locked file, ACL

It's by design. The OS lets you harvest a backup interval as the user. It also lets you delete all instances of a file.

Philipp

Sure, if I can do it, it's very easy to program it. I could write a bash script to do that ;-)

bmike

I'm hoping they sandbox it if this becomes a risk.

yup - trivial in bash, python, whatever.

Philipp

I understand that a user need to have the ability to delete a file from the backup. But he should only be able to do this via the backupd process. And that should require an admin password.

bmike

Mar 8, 2016 19:24

Also - the time capsule probably doesn't even care who has the password for the disk. Any OS could connect to your sparse bundle there

Deleting all instances does prompt for password in the UI

tmutil delete is sudo I believe

Philipp

Well, that doesn't help very much, does it?

bmike

if you get shell, though

game over

Philipp

If one can just use rm, game over, as you say

Well, we can talk all night about our wishes for architectural changes. But for the present issue, I think I am clear now. Thanks a lot for this

bmike

rm needs you to change the ACL for . - I haven't tested that, but you could remove inherited ACL, change the dir.

Cheers and thanks for the great post.

Philipp

Do I/we need to do something in the post to sum it up?

bmike

Mar 8, 2016 19:27

feel free to edit my post heavily

or to change yours. - just commenting that you reproduced the issue / cleaning up the comments might help others.

Philipp

I'll write a brief comment.

Thanks again and catch you later!

bmike

I'll purge all but one comment - flag if you want that deleted :)

Ask Different Chat

Participants