Mount(ain) of Bugs

The talk walks through how macOS mounts volumes and how the kernel's mandatory access control framework hooks into the mount system calls. It explains that the disk arbitration service runs as root and is reachable from sandboxed applications, so it performs mounts on behalf of callers and depends on its own ownership and sandbox checks.

The middle section reviews past macOS bugs where mounting was central. These include an authorization reference exposed through a predictable temporary directory that could be replaced with a RAM disk, a time-of-check to time-of-use race in the disk arbitration service that allowed mounting over root-owned paths, and a snapshot mount that bypassed privacy controls. Further cases cover replacing the privacy database with a disk image, abusing the app translocation service to read protected folders, and mounting over predictable installer temp paths to reach root code execution through periodic scripts.

The closing part notes that several issues were addressed by adding sandbox checks, requiring file descriptors, or tying snapshot mounts to full disk access, though some of these design choices remain contested. The Q&A touches on the speaker's experience with Apple's bug bounty program, describing long waits and uneven communication. The takeaway for practitioners is that mount operations are a powerful primitive for both privilege escalation and privacy bypass, and that any privileged process trusting a user-controlled path deserves close review.