Saint Batsignal, Who Called Spotlight in the Night

Patron of Spotlight and its daemons, symbolic links, and whoever indexes unknown disks.

Life

Gergely Kalman described a macOS privilege escalation he called batsignal: Spotlight's daemons, mds and mds_stores, ran as root and wrote their index files onto the volume itself, where a user can mount a disk image. By renaming the protected folder and planting a symbolic link, you got Spotlight to write a passwordless root line into /etc/sudoers. Apple fixed the pieces over 2022; the bug at first did not even have a CVE.

Prayer

O Saint Batsignal, who lights Spotlight like a beacon in the sky, let our root daemons not follow the links they find. Amen.

How to celebrate

Celebrated by updating macOS and remembering that even an indexer, if it runs as root, deserves respect.

Follow another's link and you end up where you didn't want to be.