<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On 10/26/21 4:44 PM, Christopher Stacy wrote:<br>
> System Version: macOS 12.0.1 (21A559)<br>
> Kernel Version: Darwin 21.1.0<br>
> System Integrity Protection: Disabled<br>
><br>
> Clozure Common Lisp Version 1.12 (v1.12) DarwinX8664<br>
> ; Loading "websocket-driver"<br>
> ? WARNING: /usr/local/src/ccl/dx86cl64 is loading libcrypto in
an unsafe way<br>
> Process inferior-lisp abort trap:<br>
> 6<br>
<br>
I suspect this may be a code-signing issue.<br>
<br>
MacOS has a feature to prevent "DLL hijacking" called "Library
Validation". This cannot be disabled without a kernel patch (and you
don't want to do that).<br>
<br>
<br>
<blockquote><font face="monospace">Starting in iOS 8 and macOS
10.10, the system offers library validation as a policy for the
dynamic libraries that a process links against. The policy is
simple: A program may link against any library with the same
team identifier in its code signature as the main executable, or
with any Apple system library. Requests to link against other
libraries are denied.</font><br>
<br>
<font face="monospace">The team identifier is the 10-character
alphanumeric string, such as YH9SZ5LKR4, associated with your
developer account, and recorded in your Apple-issued signing
certificate.</font><br>
</blockquote>
<br>
I didn't see this issue at all in the last version of Big Sur. But
when I installed Monterey I get the above error right away when I
tried to load the CCL program I was working on (fine) before the OS
reboot.<br>
<br>
The protection is supposed to be enabled at the app level by a
codesign option. (Since I'm running the same binaries, I don't know
why this wasn't a problem before. Something to do with the new OS
obviously.)<br>
<br>
I might be off-track with this, because the sample error message for
failing this doesn't look like the one I am getting from CCL. (Maybe
that has something to do with CCL using an older API or something,
though. I have no idea what I am talking about.)<br>
<br>
<blockquote><font face="monospace">The error string includes the
name of the process, the pid, and the path to the dynamic
library. For example, the process ls with pid 528 trying to load
the library /private/tmp/libncurses.5.4.dylib generates the
following output:</font><br>
<br>
<font face="monospace">AMFI: ls(pid 528) - [deny-mmap] mapped file
does not have a matching team identifier: /private/
tmp/libncurses.5.4.dylib</font><br>
<br>
<font face="monospace">AMFI: ls(pid 528) - [deny-mmap] process has
team identifier BGHDFMN54X: /private/tmp/ libncurses.5.4.dylib</font><br>
<br>
<font face="monospace">AMFI: ls(pid 528) - [deny-mmap] mapped file
has team identifier GDASFLKMKO: /private/tmp/
libncurses.5.4.dylib</font><br>
<br>
</blockquote>
<p>Does anyone know what's actually going on and how to work around
it?</p>
<p>I am just trying to use quicklisp to load the web drivers I need.</p>
<p>Dead in the water.</p>
<p>As I guess everyone is who upgrades to Monterey.</p>
<p>Btw, Monterey seems quite zippy on this 2014 Mini!<br>
</p>
<p><br>
</p>
</body>
</html>