- Concerns About Physical Access
- Dual Booting and the Classic Environment
- Staying Current with Mac OS X
- User Accounts and Access Control
- Filesystem Encryption
- Summary
This chapter is from the book
This chapter is from the book
This chapter is from the book
Dual Booting and the Classic Environment
The idea of running more than one operating system on a single host is a relatively new idea to mainstream Mac users. The idea of dual booting a host where you can select from several operating systems at boot time has been common on the PC platform for years. PC users may commonly have several operating systems they use depending on their needs, especially if the user periodically uses Linux.
Classic and Mac OS 9
With the advent of Mac OS X, running two operating systems became a fact of life for most Mac OS X users. Mac OS X is a completely different operating system from previous versions of Mac OS. Rather than attempt to provide backward compatibility with previous Mac OS applications directly within Mac OS X, Apple opted for what it calls the Classic Environment. Classic provides support for previous apps by actually running a previous version of Mac OS on top of Mac OS X. Mac OS X effectively provides an emulation environment for Mac OS 9 to run in as a complete operating system. Mac OS 9 runs as a process within Mac OS X.
When a Classic application launches, Mac OS X automatically launches Classic to provide an environment for the application to run in. If you click the collapsible triangle, you can actually see Mac OS 9 booting within Mac OS X (see Figure 3.6).
)
Figure
3.6 The hidden Mac OS 9 startup window.
Classic requires a great deal of system resources to run. Because you are running two complete operating systems at one time, your machine's resources are split between them. Most notably, Mac OS 9 uses a large amount of RAM. Mac OS X gives Classic hooks to other resources, such as disks and network interfaces.
Like any other application, it is best to remove or not install Classic if you do not require it. Even though Classic is run through emulation on the host, it has access to many of the system's sensitive devices. Mac OS X attempts to intercept access to restricted data or devices through the Security Services interface. However, this method may not be bulletproof to all types of attacks.
OS 9 and OS X 10.2
Starting with OS X 10.2, Apple no longer ships an OS 9 disk with the main operating system. This is a step by Apple toward phasing out OS 9 support. If you need Classic support under 10.2, you will need to install media purchased separately. Going forward this move by Apple means there will be fewer and fewer OS X machines with the Classic environment.
Dual Booting Dangers
The Mac platform provides a means to boot multiple operating systems on the same host. This capability is controlled by the Startup Disk control panel. If you have Classic installed on a host, you have the opportunity to boot directly to Mac OS 9. This option is provided for applications that require direct hardware access under Mac OS 9. Mac OS X runs Classic through an emulator. This emulator abstracts the hardware from Mac OS 9 applications. If an application uses special hardware or needs low-level access, booting directly to Mac OS 9 provides a means for these specific applications to work. For example, a video game may have been written to directly access a joystick connected to a host. This game will not work properly under Mac OS X.
Mac OS 9 has very few security features compared to Mac OS X. When Mac OS 9 is booted on a host that also contains Mac OS X, many of the security features of Mac OS X are completely bypassed. Mac OS 9 has complete access to all the hardware on a host, and subsequently has access to all the data on that hardware. Filesystem level access control, such as files limited to only the superuser account, can be bypassed within Mac OS 9.
If you require Classic applications without direct hardware access, you can install Mac OS 9 into a disk image created with DiskCopy. This disk image will automatically be mounted by Mac OS X when it needs to launch the Classic environment. However, because the disk image is a file within Mac OS X, it prevents direct booting to Mac OS 9. If you require direct hardware access in Mac OS 9, be sure you install an OpenFirmware password to prevent unauthorized booting.
NOTE
Starting sometime in 2003, hardware shipped from Apple will no longer have the capability to boot to OS 9 directly. It will allow OS 9 access only through Classic regardless of how OS 9 is installed.
To help mitigate the risk of an Mac OS 9 application accessing Mac OS X data, you should ensure Mac OS X is installed on a UFS partition. Mac OS 9 cannot natively read UFS filesystems. Therefore, data stored on the UFS partition will be safe from modification due to Mac OS 9 applications.
Other operating systems, such as Linux, can be booted on a Mac. These other operating systems may also have the capability to bypass the security model of Mac OS X because they have direct access to the hardware. Even worse, the Mac OS X installation can be used to boot a host and reset the root password. Again, the best option if you have to boot to two bootable operating systems on a host is to require an Open Firmware password.