Public/VeraCrypt
1
0
Fork 0
mirror of https://github.com/veracrypt/VeraCrypt.git synced 2026-07-06 13:08:00 -05:00
Code Activity

macOS: run APFS formatter elevated

Browse Source 
APFS volume creation can still fail with Permission denied after preparing the raw and block device aliases because newfs_apfs performs privileged APFS container and volume operations beyond opening the device nodes.

Route APFS formatting through the elevated CoreService path for non-root macOS runs. Keep the elevated interface narrow by sending only the target device and invoking user UID/GID, validate the device path on the privileged side, rebuild the formatter arguments there, and execute /sbin/newfs_apfs by absolute path to avoid PATH shadowing.

Pass -U/-G so the created filesystem preserves the invoking user ownership. Apply the same path to GUI and text-mode creation.
This commit is contained in:
Mounir IDRASSI
2026-05-15 10:51:27 +09:00
parent 213dd2e74a
commit 77e4830c99
9 changed files with 224 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Core/Unix/CoreServiceRequest.cpp
+29
View File
@@ -219,6 +219,32 @@ namespace VeraCrypt
CoreServiceRequest::Serialize (stream);
}
#ifdef TC_MACOSX
// ExecuteMacOSXAPFSFormatterRequest
void ExecuteMacOSXAPFSFormatterRequest::Deserialize (shared_ptr <Stream> stream)
{
CoreServiceRequest::Deserialize (stream);
Serializer sr (stream);
Device = sr.DeserializeWString ("Device");
sr.Deserialize ("OwnerGroupId", OwnerGroupId);
sr.Deserialize ("OwnerUserId", OwnerUserId);
}
bool ExecuteMacOSXAPFSFormatterRequest::RequiresElevation () const
{
return !Core->HasAdminPrivileges();
}
void ExecuteMacOSXAPFSFormatterRequest::Serialize (shared_ptr <Stream> stream) const
{
CoreServiceRequest::Serialize (stream);
Serializer sr (stream);
sr.Serialize ("Device", wstring (Device));
sr.Serialize ("OwnerGroupId", OwnerGroupId);
sr.Serialize ("OwnerUserId", OwnerUserId);
}
#endif
// MountVolumeRequest
void MountVolumeRequest::Deserialize (shared_ptr <Stream> stream)
{
@@ -294,6 +320,9 @@ namespace VeraCrypt
TC_SERIALIZER_FACTORY_ADD_CLASS (EmergencyDismountVolumeRequest);
#endif
TC_SERIALIZER_FACTORY_ADD_CLASS (ExitRequest);
#ifdef TC_MACOSX
TC_SERIALIZER_FACTORY_ADD_CLASS (ExecuteMacOSXAPFSFormatterRequest);
#endif
TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSectorSizeRequest);
TC_SERIALIZER_FACTORY_ADD_CLASS (GetDeviceSizeRequest);
TC_SERIALIZER_FACTORY_ADD_CLASS (GetHostDevicesRequest);