Repository navigation
ios-27: the key store and data protection notes and the on-phone test (#277 re-landed) - #297
Merged
Merged
Conversation
…he on-phone test dptest, fork 5eac319 The fork's wip/ios27-keystore (on the built-in boot arguments): protection classes on the built-in HFS as labels (sweetspeed&0x100000, &0x200000 for MNT_CPROTECT) and the key store's answers for a device with no passcode (sweetspeed&0x400000). Built, not booted yet.
…e; dptest's passcode mode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands pull request #277 (
wip/ios27-keystore) on today's main: its four commits re-created on main with their author and dates. Theirprofiles/ios-27.confhunks are left out (they pinned fork branches of 9 November; the fork side, Scion-Project/xnu #4, is in the trunk and main's pin is later). Nothing else is changed. #277 will not close by itself.docs/ios27/KEYSTORE.md: what iOS 27.0.1 asks of the key store and of data protection, and what the S9's kernel answers.tools/ios27/keystore/:dptest, an on-phone test (a launchd job that writes a report), with its build and install scripts for one's own root image.From #277: "Two of its bits are proven on a Galaxy S9 and ride in the RC1 kernel line; the notes say for each bit what ran and what did not", and "Nothing is encrypted by any of this: classes are labels, the keychain's keys are not protected at rest (as before), and the passcode is a screen lock."
To judge before merging:
dptest.entitlementsgives the test program Apple's private key-store and keybagd entitlements,platform-applicationandcom.apple.private.security.no-sandbox. It is our own test binary, installed only by hand into one's own root, and it tests our kernel's stand-in; but it is the one file here that is not notes.No file the ios-27 or 16.5 kernels are built from is touched (docs and
tools/ios27/keystore/only), so no kernel was rebuilt. All 27 steps of thecheckworkflow pass locally. Not run on a phone by this branch.npm run preflightdoes not apply (no Node project).🤖 Generated with Claude Code