Library Validation failing intermittently for sudo plugin

Our product includes a sudo plugin so we can apply user-defined policies to manage privileged access to command line programs. We’ve been getting reports where the plugin sometimes doesn't get invoked and the sudo command falls back to its default behavior. This seems to only be happening intermittently, but when the issue does occur, this message appears in the Console:

Library Validation failed: Rejecting '/usr/local/libexec/sudo/<our_plugin>.so' (Team ID: <OURTEAMID>, platform: no) for process 'sudo(<pid>)’ (Team ID: N/A, platform: yes), reason: mapping process is a platform binary, but mapped file is not

I recall a previous discussion of this message (that I can’t locate now), which explained that although the host process has library validation disabled, the code flow raises an error anyway, so that the host process can detect it and bypass the validation to load the plugin. It looks like that's what sudo is doing: it has the private entitlement com.apple.private.security.clear-library-validation and makes the appropriate system call when the plugin initially fails to load [1] — but apparently this isn't working reliably for our sudo plugin.

We’ve observed that restarting the Mac generally resolves the issue, at least for a while. This resembles the “classic symptom of a code signing oddity” where the signature is cached and the Mach-O image is rewritten rather than replaced (as documented in Updating Mac Software). But our software uses an Installer package for updates as well as initial installation, and the Installer is documented as not having this issue, so I believe the problem lies somewhere else.

I’m running out of ideas; are there any other avenues I should investigate? Thanks for any help.

[1] This is described in an article called "About com.apple.private.security.clear-library-validation"; I can't link to it directly from the developer forums, but it can easily be found by searching for the title.

the code flow raises an error anyway

That’s correct.

I recall a previous discussion of this message (that I can’t locate now)

It took a few minutes but was able to track it down. See this post.

I can't link to it directly from the developer forums

You probably can, you just need to do it in the clear. See tip 14 in Quinn’s Top Ten DevForums Tips.

We’ve observed that restarting the Mac generally resolves the issue

Interesting. You’re right that this would normally indicate a code-signature caching issue, but that’s contra-indicated by your use of the installer.

Given that this happens rarely and is fixed by a restart, it’s unlikely to be a problem with your code. My advice is that you work with one of your affected customers to take a sysdiagnose log shortly after reproducing the problem, then file a bug with that attached.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I've filed a bug report as FB13798038.

Thank you for tracking down that previous discussion. I think I was searching for the error message rather than the text "Library Validation".

It's very on-brand that your top ten list now goes to 14. ;-) The article I mentioned is here: <https://theevilbit.github.io/posts/com.apple.private.security.clear-library-validation/>

As always, your assistance is invaluable. Thanks again.

I've filed a bug report as FB13798038.

Thanks!

It's very on-brand that your top ten list now goes to 14. ;-)

Well, it used to only go to 11 (-:

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

To close the loop: The Apple engineer responded to my bug report by politely suggesting that according to the sysdiagnose logs I had sent, the sudo plugin was loaded and sending an XPC message to our policy engine in every instance.

To my embarrassment, they were correct — the sudo plugin was not responding to an internal error in our policy engine in a way that was readily distinguishable from failing to run at all, and unfortunately I bit on what turned out to be a red herring.

Now I have a new (and hopefully more productive) area to investigate. Thanks for your attention.

Library Validation failing intermittently for sudo plugin
 
 
Q