3

I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after proceeding to normal login (such as background SSD deletion). I was hoping to achieve an end result much in the same way that TrueCrypt allowed you to do when configuring the initial encryption:

It will now prompt you to enter the outer volume password. This is the password you might have to divulge under duress.

So far I've found no TrueCrypt alternative (maintained or otherwise) that I can use with OS X, so I've attempted to emulate this to an extent by either adding a script to /etc/passwd and also using the Directory Utility in order to modify the login script.

Thus far I have been unable to find such a way to accomplish this, though I have found a field in the Directory Utility that may correlate to the password of the user (as shown in the image below) but am unable to find a way to link it to a script or add any extra layers of authentication.

Directory Utility

I know that you can do this on a plain UNIX system with the /etc/passwd script mentioned above and here. Find below a flowchart visualising what I'm trying to do as well, in case I explained this poorly.

Flowchart

Is it even possible to do this on an OS X system, and if so, how?

Improve this question
1
  • 1
    Use the source, Luke.
    – hildred
    Jun 26, 2015 at 20:42

1 Answer 1

Reset to default
1

FileVault (and OS X in general) does not check /etc/passwd, so a script using it as a trigger will not work.

FileVault uses DirectoryServices, so any interception of what is being entered has to be through Apple's OpenDirectory implementation (see documentation on DirectoryService).

How to do that is beyond me, but reading up on https://developer.apple.com/library/mac/documentation/Networking/Conceptual/Open_Directory/openDirectoryConcepts/openDirectoryConcepts.html might be enlightening. I assume Apple has some way of accessing FileVault through Cocoa/Obj C/Swift that you could leverage.

Of course, the usefulness of this all hangs on the assumption that the closed part of your OS doesn't already have a backdoor in it such that someone would not even bother asking you to decrypt the filesystem in the first place.

Hope that points you at least in a useful direction!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .