![OS X Leopard 上的权限问题;这是否表示篡改或恶意软件?](https://linux22.com/image/1275509/OS%20X%20Leopard%20%E4%B8%8A%E7%9A%84%E6%9D%83%E9%99%90%E9%97%AE%E9%A2%98%EF%BC%9B%E8%BF%99%E6%98%AF%E5%90%A6%E8%A1%A8%E7%A4%BA%E7%AF%A1%E6%94%B9%E6%88%96%E6%81%B6%E6%84%8F%E8%BD%AF%E4%BB%B6%EF%BC%9F.png)
基本上,看起来很多权限都从 更改为rwx------
(rwxrwxrwx
或非常接近于此);我认为其中一些涉及 Mac 的 Java。我最近对 OS X 10.5 进行了存档和安装。
这是否表明我的系统被篡改或被恶意软件感染?
修复内容如下:
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/DVD.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSettings.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSources.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Movies.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Music.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Photos.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Podcasts.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/TV.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/PrivateFrameworks/BackRow.framework/Versions/A/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be -rw-rw-r-- , they are -rw-r--r-- .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be -rw-rw-r-- , they are -rw-r--r-- .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be -rwxrwxr-x , they are -rwxr-xr-x .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be drwxrwxr-x , they are drwxr-xr-x .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be -rw-rw-r-- , they are -rw-r--r-- .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be drwxrwxr-x , they are drwxr-xr-x .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be -rw-rw-r-- , they are -rw-r--r-- .
Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be 80, group is 0.
Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be drwxrwxr-x , they are drwxr-xr-x .
Permissions differ on "System/Library/Frameworks/AppKit.framework/Versions/C/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/DotMacSyncHelper.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/dotmacsyncui.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/PrivateFrameworks/DotMacLegacy.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeDirectory", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeSignature", should be ?--------- , they are -rw-r--r-- .
Permissions differ on "System/Library/SystemProfiler/SPDisplaysReporter.spreporter/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
答案1
根据我的经验,其中大部分都是 Apple 自己的补丁,不太干净。您会发现符号链接指向插件的版本树,就像具有Versions/A
子树的框架一样。
不过,我不确定该怎么处理这些should be ?---------
文件;这表明 BOM 文件中有垃圾。我会用它pkgutil --file-info
来找到正确的软件包文件,然后用其他pkgutil
命令检查它和/或lsbom
看看哪里出了问题,但你必须对 Apple 的软件包格式有所了解才能理解它。