I'm dealing with some issues regarding my MacBook that have me confused. When I launch my system in recovery mode I'm in a linux shell that mirrors the same environment/file system I have when I boot my system normally. However when I boot normally, the shell is UNIX. The commands are different, capitalization, and other variuables that differentiate the 2 change. echo $OSTYPE returns the same value in both instances(Debian 14.04) Any idea why this is happening?

The main thing I'm looking to accomplish is regaining admin rights/sudo privileges which I currently don't have, nor can I modify the files to manually reconfigure things. Any suggestions?

Booting into about any Linux with runlevel 1 should get you root privs unless you explicitly made it ask for a passwd?

for sudo it prompts for password and when I enter it it reads myusername not in sudoers file. My UID goes from 0 to 501 when in recovery vs regular startup mode. when I run login I can't even get the correct user name. It's a rather complex issue I've been dealing with for sometime.

Heres the (more complete) explanation I posted to stackoverflow without any success:


've got a problem that I am trying to solve. Consider it an academic excerisize in familiarizing myself with some computer science fundamentals.

I'm trying to determine the core Kernel/OS on my system. Here's why it's difficult:

The interface I use when launching my system normally appears to be as expected (Mac OS X 10.10). The shell is UNIX and accuratly reflects what a UNIX local file system would look like. However there are users higher than me in the system, and multiple disks being mounted and unmounted at will without me physically or virtually executing the task. The disk mounted at the root directory is a dmg and isn't on the same disk as my HD/SSD. Also, when I launch my system in recovery mode I'm in a linux environment that mirrors my UNIX filesystem but the commands and syntax are linux. In recovery mode I cannot login and every file from root to 3-4 levels down is mounted read only. Although the shell interacts like a linux system the Kernel appears to be launchd and is initiated from the path /sbin/launchd.

When I start my system normally the shell reverts back to UNIX and the directories that are read only in recovery mode are no longer classified as such.

It's obvious to me that the environment I'm in is not on my local machine but is acting as a hypervisor mimicking the UNIX/MAC OS Env. My question is around how I can go about regaining control of my system.

I can't access the Firmware and when I launch a terminal I don't have admin rights to download a new kernel, alter paths, add/remove users or perform any of the functions necessary to rebuild my system.

I've exhausted everything I can think of. My suspicion is that its a networking issue related to some internal hardware (i.e. a wireless card). However if I can't communicate directly with my system via Shell I don't know what to do.

Any advice?

Again, I know there are likely questions around how I ended up in this predicament. Let's just say I was handed a computer (MacBook Air) and told to figure it out.

While it's been a great educational endeavor, it's starting to loose it's appeal. My thoughts are, with physical access to the system I should be able to regain control. Anyone have any strategies as to how?

I don't know how well-versed you are in all things Linux but the basics you should familiarize yourself with first I think. Lots of documents on the 'net. Please answer questions below as detailed as possible, meaning no more observations or speculation but actual unambiguous tool output instead. (And please note questions are there to help clarify the situation.)


Please be precise and verbose (we're not at the keybd so we can't see or guess): when does this occur? In Mac OS X? Or linux?


Yes, in recovery mode there is usually only root. That enables you to change things. Sometimes you may have to mount or '-o remount,rw' stuff first.


Login where? How? In Mac OS X? Linux? Recovery mode?


Please show proof: 'ps axf -eopid,ppid,user,group,cmd;'-like output plus dmesg / messages excerpts?


Please show proof: 'mount;' output would be a start.


Mac OS X recovery mode or what other method?


Enter recovery mode then show us 'mount;' output?


'uname -a; ps axf; mount; dmesg'


That seems to be expected?


I'm not able to concur without proof given.


In your case I would stay away from further complicating things by fiddling with things like firmware.


No idea what course or company would have you do such a thing?..

1 members found this post helpful.

I feel unSpawn has you on a good path, but I did have a question about your initial post, you wrote:
My understanding is that MAC OS is Darwin at its core so I am a little confused as to how Debian is being mentioned?? Is it possible you have more than 1 distribution running on this machine?

Thank you. This is helpful and new information. I'll work through the instructions you've sent and document everything I can and post back with any issues. I appreciate the help. And it is Darwin. Guess I just had Debian on the brain. And my concern is that I dont have any distribution running on my system.

Regarding what company or course would do this... Im trying to spare the details and that seemed like a good way. It's def not a course, or company in the traditional sense. You'd be surprised but there are a lot of sick people out there with god complexes. You can never be too cautious.

Ok I did some digging and I've attached some pictures that provide more information.

Regarding the "expected vs delivered" behavior. I should not be on a network other than my own localhost and a simple wifi internet connection through comcast. My Kernel and OS should be UNIX and the experience if I didn't begin to question some suspicious behaviors appears to be as advertised.

I've come to the linux forum as my suspicion is I've been placed on a network/system thats operating on the Linux Kernel (I believe it to be Ubuntu OS but can't confirm,) I was able to confirm this by launching the recovery terminal as root and executing commands that were case sensitive. Which if I'm not mistaken matters in Linux not in UNIX. When I boot normally and launch the terminal case doesn't matter again (as per UNIX).

Attached you can see
how I'm not in the shudders file = No_sudo
the recovery Disk Utility = recovboot_diskutil
I've attached the output of the ps aux command in recovery and normal respectively: recovboot_ps, regbootps
-On thing I noted here- the kernel is not the first process to execute. usr/libexec/sandboxd -n pluginprocess -n is. Networkd is executed simotaniously

The ls output of my dev directory: DEV_dir. This is a TON of devices of which I did not add, and have no knowledge of.

I've got more pictures of the login prompt, the mounted read only file system etc. if it will help. Only allowed 5 uploads per post. I appreciate the help. If you can share any insight this information gives you or have other ideas for resolving the issue you'll be really helping me out.

Thanks in advance

Attached Thumbnails

         

So you are running MacOS and bash is what you call Linux shell?

OS X is BSD UNIX.

What you are seeing is the shell which is the text-based User Interface to your system.

More digging is needed because it is unproductive to go further on wrong guesses. Some of the advice above in earlier posts should have confirmed it for you. The program uname mentioned there will tell you the kernel.

If you are indeed using Ubuntu then the following will tell you which version.

If that program is not found, you are not on Ubuntu.

However, your screen shots show that you are actually using OS X which as mentioned above is mostly BSD, not Linux. But the shell you are using is Bash, and that is also common on GNU/Linux systems. If you are on OS X, then the following will work:

Again, if that runs at all you are on OS X (BSD) and not GNU/Linux.

In OSX the simpler way to add an admin account is to boot into single user mode (like you did, boot while pushing "apple key" and "s" down), then
On next boot, follow the "Apple Welcome" setup to add an user with admin privileges

1 members found this post helpful.

Thanks for the replys. As I mentioned, when I boot up I am taken into a Mac OS environment. Here's the output of the name and sw_vers commands:

Austins-Air:~ austinclowdus$ sw_vers -productVersion
10.10.5
Austins-Air:~ austinclowdus$ uname -a
Darwin Austins-Air.hsd1.ga.comcast.net 14.5.0 Darwin Kernel Version 14.5.0: Wed Jul 29 02:26:53 PDT 2015; root:xnu-2782.40.9~1/RELEASE_X86_64 x86_64

My concern is that this environment is not running on my local machine. I've tried reinstalling OS X several times (from recovery boot and backup) and it will go through all the install steps but when I reboot I'll be in the same interface (same username, passwords, files, etc) that existed before my install.

I think the question that would really help me out is - If someone wanted to put code or hardware on your computer that cause the hardware-> software handoff to take you to an external network/machine, what would they have to manipulate to do so?

IF you look at the ps aux output you can see theres a process executed prior to the kernel. I think this is something thats a productive use of time to investigate further. Unless this is common? I've never seen/heard of a pre kernel process running. How is it launched? From where? what command would show me? I'be tried ps f and launchctl blame but both command flags are disabled

This post should be in the Other *Nix forum. It's clearly about OS X, not Linux. OP misidentifies a text-only terminal as a "Linux terminal", but the OS is definitely OS X (see screenshots from OP).

I've asked admins to migrate this post, for better and more apropos visibility.

There are several subsystems used by OS X that abstract UNIX user accounts from OS X. The reason you feel that the text environment you get in Single User mode is different than the environment you get after a standard boot is that 1) you're not running as the same user (you're root in Single User) and 2) without Directory Service (the `dscl` command is your interface to Directory Services; see man page or online docs) local user management, much of the data about your user account(s) is not loaded in Single User mode.

The reason you believe your re-installs are failing is because OS X's default behaviour is to preserve user data. If you want a true re-install, re-boot to a re-install disk, format the drive to wipe it completely, and then install. In other words, don't "re-install", just nuke and install.

Remember that an Apple® MacBook ... as shipped from Cupertino ... is running OS/X, which is a flavor of Unix, not Linux. Am I correct to assume that you have zapped OS/X on this box and are now running Linux natively?

1 members found this post helpful.