KAUTH_SCOPE_FILEOP issue when using HFS+ zlib compression

Originator:mitas
Number:rdar://23029109 Date Originated:08-Oct-2015
Status:Open Resolved:
Product:Mac OS X Product Version:all
Classification: Reproducible:
 
ummary:
When writting a file with the transparent zlib compression enabled to the HFS+ filesystem (e.g. ditto --hfsCompression /etc/passwd /tmp/), a KAuth callback registered in the KAUTH_SCOPE_FILEOP does not get the flag KAUTH_FILEOP_CLOSE_MODIFIED when the target file of the ditto is being closed.

This happens even when the file is copied from different filesystem (e.g. a network share or removable device).

Therefore the target file simply likely bypasses any indexing, backuping or antivirus tools which may rely on the KAuth mechanism.

Steps to Reproduce:
Compare KAuth callbacks within the KAUTH_SCOPE_FILEOP when using ditto with and without the --hfsCompression command line option.

(If you find it useful, I can provide a Kext logging all such callbacks into system.log.)

Expected Results:
Using the HFS compression should not have any impact on the data passed into the KAuth callbacks.

Actual Results:
See description.

Version:
Probably any OS X version. Tested on 10.8.5 build 12F45, 10.10.5 build 14F27, 10.11 build 15A284

Notes:


Configuration:
All configurations.

Attachments:

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!