ShadowClassic 1.0.1

Lab administrators face many challenges when trying to deploy Mac OS X systems with an installation of Mac OS 9. Perhaps the toughest challenge faced is that Mac OS 9 does not offer the same security structure that is offered through Mac OS X. A user could potentially boot a machine into Mac OS 9 to subvert the Mac OS X security structure and do considerable damage to the Mac OS X system.
To prevent this from occurring, lab administrators can take several measures including:
1. Choose to not install Mac OS 9
2. Do not install the Mac OS 9 drivers when formatting the drive
3. Enable the Open Firmware password on each machine
4. Run the Classic environment from a disk image
Each of these procedures has advantages and disadvantages, and none of them can provide the best solution by itself. Clearly the first solution will prevent a user from booting into OS 9, unless the user has a bootable CD or a firewire drive with Mac OS 9 installed.
The second option offers excellent security insofar as if the machine is booted into OS 9, the OS 9 environment cannot see the OS X disk at all (the Classic environment can, of course, see the OS X disk while booted into OS X). This method, by itself, also does not prevent users from booting the machine from an external device or CD, and it also prevents you from assessing the drive with OS 9 utilities.
Enabling the Open Firmware password, with the Open Firmware Password utility, prevents users from booting the machine without either access to an administrative account or knowledge of the Open Firmware password. This tool can also be used to prevent the machine from booting at all without entering the password, though that particular implementation would probably not be appropriate in a lab setting. I recommend implementing this security step in addition to any other solution you use to secure your computers.
There is an unfortunate situation with some poorly written Mac OS 9 applications in which they require the ability to write back to their own directory. This security problem is only addressed by the last option, which is the most flexible option for securing the Classic environment. This is not an easy issue to address though: how do you secure items that must be read/write by all users? The best solution that I have seen so far is to install the Classic environment onto a disk image, lock the disk image, then mount the disk image with a shadow file. Locking the disk image makes it read-only, preventing users from changing its contents, but the shadow file allows it to appear as writable. Instead of making changes to the contents of the disk image, though, the changes are written to a temporary file. You have the choice of reusing that file (per user) to allow for persistent changes or you can delete that shadow file every time so the Classic environment is presented to the user in a pristine state every time.
Ideally, such a system would be completely automated. As of Mac OS 10.2, the Classic environment allows booting from a disk image (and will even mount a disk image automatically when Classic is started), which is a huge step in the right direction. Unfortunately, the Classic startup application does not provide a way to mount the disk image with a shadow file.
In response to this, some clever folks at the Mac Support group at the University of Utah and the University of Colorado Boulder (Jeff Greene) came up with a shell script to replace the executable inside the Classic Startup application that mounts a disk image with a shadow file, then executes the original executable which initiates the Classic environment. Shadow Classic is a simple little application that I created to make the implementation of this method as easy as clicking a button. The instructions for complete setup follow.
Enhancements:
- Fixed a minor problem that prevented Classic from launching after the disk image is mounted.