Dear Apple Developer Community,,
I understand that RPC is not the recommended IPC mechanism for communication between an Endpoint Security (ES) Extension or a Network System Extension and a daemon. However, I would like to clarify whether Apple currently allows the use of RPC (clnt_call()) as an IPC method for these extensions to communicate event details to a daemon.
Given that ES Extensions operate in a sandboxed environment, they may lack the necessary permissions to create network sockets (e.g., clnt_call() over TCP) on a properly signed macOS system with SIP enabled (macOS Sequoia).
Looking for clarification on the following points:
Whether RPC (clnt_call()) is currently supported as an IPC mechanism for ES Extensions or Network System Extensions?
If supported, does Apple have any plans to deprecate RPC-based IPC (such as clnt_call()) in the near future for these extensions?
I would appreciate any insights or references to official documentation on this topic.