I ran into a strange problem during development this morning. When trying to install my Endpoint and Network System Extensions (something I was able to do yesterday, and many times before), my Mac is prompting me to enable Kernel Extensions. Right before this happened, I had problems deleting the previous version of the apps from the /Applications folder (it took many tries). This too was unusual. After agreeing to allow the installation of my Endpoint System Extension, I was greeted with this previously unseen message and button: When I click "Enable System Extensions...", and I am greeted with this alert: I also ran into this problem when trying to install my Network System Extension. Anyone have any idea how I screwed up my system? Anyone know how to return it to normal behavior? System: Mac Studio 2022 OS: Ventura 13.4.1 (I'm thinking of re-instaling Ventura this evening; would prefer not to)

I have a regular GUI-based app that communicates with an Endpoint System Extension installed by another app. Both the GUI app and Endpoint System Extension have the same Team ID and are part of the same App Groups. But I still need to do one of the following to the GUI-based app to allow it to communicate with the Endpoint System Extension over XPC: Disable the sandbox Add com.apple.security.temporary-exception.mach-lookup.global-name to entitlements For some reason I thought there was another way to resolve this. Am I missing anything? (My goal is to allow an app distributed through the Mac App Store to communicate with my Endpoint System Extension if it exists, and I am worried about the "temporary-exception" entitlement needed to support this.)

I got the permission from Apple (yay), and when I generate a profile on the portal, I can select it. But when I download it... it doesn't have it. Looking at the profile on the portal again, it says I have "Enabled Capabilities Endpoint Security, In-App Purchase". (Although how did that get there?)

Hello, As I understand it, the ES framework provides notifications for specific event types. For my question, auth events do not matter, as I'm not interested in allowing/denying events, just reporting. Is there a way to retrieve the information if an event was successful/failed from an ES message? So far, I have found nothing in this regard in the documentation. For example, under certain circumstances, I get two notifications if I try to delete a file via the Finder, for which administrator privileges are required. The first is when the authorization dialog appears (this notification is for the failed unlink event), and the second is when I enter the correct credentials and the file is deleted. Example for reproduction: Open a terminal and create a file in "/etc" with the command "sudo touch test.txt". Run the command 'sudo eslogger unlink | grep -E "test.txt"' to start monitoring UNLINK events for files named "test.txt". Open the folder "/etc" in Finder. Select the file "test.txt", click on "File" in the menu, and hold the option key pressed. Then select "Delete Immediately...". In the appearing dialog, click on "Delete". Before entering the administrator password, and while the credentials dialog is still open, observe that eslogger already reports an UNLINK event for this file. It reports the user information: "ruid":501,"euid":501,"rgid":20,"auid":501,"egid":20. Enter the administrator password to confirm the deletion of the file. Observe that eslogger reports a second UNLINK event for this file. This time with the user information: "ruid":0,"euid":0,"rgid":0,"auid":501,"egid":0. So, is there a way to check the first event for failure? Otherwise, I would need to check manually if the file is still there after receiving the first notification, if I only want to report events that "really" happened (excluding attempts).

I wrote a program to receive the notify events from endpoint security framework. ES_EVENT_TYPE_NOTIFY_AUTHENTICATION event is not notified/logged in any scenario. Please help me with the information on when does mac generate or notify this event.

I wrote a program to receive the notify events from endpoint security framework. While logging into the workstation it generates ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN event. How to get the user id and other user info from this event.

Hi guys Following this topic : https://developer.apple.com/forums/thread/654443 I test this in macOS 14 beta, audit can't work now. Is it expected or a bug? If it is expected, is there any announcement ? Thank you! Command return error: sudo audit -i Error sending trigger: (ipc/send) invalid destination port

I created a Endpoint Security the client, the System Extension have been normal load to/Library/SystemExtensions inside, and has been activated, but did not see the Extension to run, do you have who knows？

My team has received a bit of instruction in the past about how to use ESClients for Endpoint Security tasks. The source suggested using multiple ESClients but not too many. I think the proposed limit was 40. The question is this: how can I determine what warrants a new ESClient? For example, consider an app that has 30 concurrent tasks of type A, a task of type B, a task of type C, and a task of type D. Should each task type gets its own ESClient? Should the tasks of type A be divided between multiple ESClients? Can you deliver any additional guidance on this?

Is it possible to use ESF framework without enrolling into Apple developer program? I wanted to try out ESF for learning purpose.

I encountered such a problem, when I am in macOS 10.15 this part, through monitoring ES_EVENT_TYPE_AUTH_EXEC ESF framework, if I double click on the start/Users/test/Downloads/test. The app, The path of test.app corresponding to message->event.exec.target-> Path. data in the ES_EVENT_TYPE_AUTH_EXEC event is under /private/var/folders. This prevents me from blocking the test.app startup in the /Users/test/Downloads/ directory through string matching.

Can I control the pasteboard when user try to Ctrl + v? There's no option or related event in endpoint security. I'm came up the 'method swizzling', but it doesn't seem like a good way. Plz help me..

I want to create a feature that monitors which USB devices my computer is using and lets me know what they are. If the USB storage device is connected to my MacOS device, I want to prevent it from being used. Is it possible to implement such a method using ESF framework? Or is there another way to do this?

Hey all! I have a System Extension that, while doing some other things, starts up my custom Network Extension via [NEProvider startSystemExtensionMode]. This Network Extension contains a class (let's call it MyDataProvider) that overrides the NEFilterDataProvider interface and implements handleNewFlow. MyDataProvider thus acts as a network content filter. The problem is that installing my System Extension on a Ventura 13.4 (or older) system and starting up the Network Extension seemingly drops any ongoing connection I have. For example, my ssh connection will hang. This makes it quite annoying attempting to install the System Extension remotely. I do not see this behavior for my other class that inherits the NEFilterPacketProvider interface. Is this behavior expected of the NEFilterDataProvider? It seems like a bug since I do not see any documentation stating this behavior.

I implemented a method to monitor the testfile copy activity and reject it using ES_EVENT_TYPE_AUTH_CLONE. The copy code used is as follows： NSFileManager *fileManager = [NSFileManager defaultManager]; NSError *error = nil; NSString *sourcePath = self.CopyFilePath.stringValue; NSString *destinationPath = [sourcePath stringByAppendingFormat:@"(Code copy file)"]; BOOL success = [fileManager copyItemAtPath:sourcePath toPath:destinationPath error:&error]; if (success) { NSLog(@"File copy successful"); } else { NSLog(@"File copy failure：%@", error.localizedDescription); } This code fires the ES_EVENT_TYPE_AUTH_CLONE event, and I treat the auth event as ES_AUTH_RESULT_DENY, but still create a new file testfile(Code copy file) How to prevent through code [fileManager copyItemAtPath: sourcePath toPath: destinationPath error: & error]; Implementation of the file copy

I am playing with endpoint security. I trying to implement block/allow user to read/write files on a USB media drive. I made my ep utility as launchctl daemon. I found that some applications couldn't start until I mute those processes for ep_client. Moreover, some system processes couldn't start until I mute messages from them. And even more, if my utility autoruns on system start, the clock on the top right corner of the screen may be absent. The Terminal app couldn't restore its state, it hangs on start. Actually, I came to that, my EP daemon should listen to very few processes. Those processes that can read/write files on USB media, and do it by user request. Or under user control. When KAUTH was not deprecated, I did it right in the kernel extension: if the vnode path is NOT on a removable drive, return DEFER at the beginning of callback. My question is: What processes are pure system? What system processes can read/write files for user or under user control? Does, for example, /usr/libexec/nsurlsessiond can download a file for user to the USB media?

I am writing a system extension and I want to get the command line. Back in kauth's days we used to get the csFlags and then the image_params, but I think that ES doesn't give us a pointer to the csFlags anymore. Tried like this: unsigned int csFlags = event->process->codesigning_flags; struct image_params* image = (struct image_params *)((char *) csFlags - __offsetof(struct image_params, ip_csflags)); But the csFlags is not a valid memory region.

I created an ES Client, as I run it, it logs all the processes under /. So I add mute_path_prefix for those. I expect to see Notifications from /Users/anoopvaidya/, but it is not happening. What am I missing here? Any help, suggestions, guidance is highly appreciated. static void handleEvent(es_client_t *client, const es_message_t *msg) { char const *filePath = msg->process->executable->path.data; NSString *filePathString = [[NSString alloc] initWithFormat:@"%s", filePath]; os_log(OS_LOG_DEFAULT, "filePathString = %@", filePathString); } void mutePath(es_client_t *client) { os_log(OS_LOG_DEFAULT,"Adding muted files list"); NSArray<NSString *> *paths = @[ @"/Applications/", @"/bin/", @"/cores/", @"/Library/", @"/opt/", @"/private/", @"/sbin/", @"/System/", @"/usr/", @"/var/", ]; for (NSString *path in paths) { es_mute_path_prefix(client, [path UTF8String]); } } int main(int argc, char *argv[]) { // Create the client es_client_t *client = NULL; es_new_client_result_t newClientResult = es_new_client(&client, ^(es_client_t *c, const es_message_t *message) { handleEvent(client, message); }); if (newClientResult != ES_NEW_CLIENT_RESULT_SUCCESS) { return 1; } es_event_type_t events[] = { ES_EVENT_TYPE_NOTIFY_CREATE, //create file ES_EVENT_TYPE_NOTIFY_OPEN, // open file ES_EVENT_TYPE_NOTIFY_RENAME, // rename file ES_EVENT_TYPE_NOTIFY_CLOSE, // close file ES_EVENT_TYPE_NOTIFY_WRITE, // write to file ES_EVENT_TYPE_NOTIFY_UNLINK, // delete ES_EVENT_TYPE_NOTIFY_EXIT }; if (es_subscribe(client, events, sizeof(events) / sizeof(events[0])) != ES_RETURN_SUCCESS) { os_log(OS_LOG_DEFAULT, "Failed to subscribe to events"); es_delete_client(client); return 1; } mutePath(client); dispatch_main(); }

IIRC, when Apple introduced the new Network Extension and Endpoint Security system extension architectures, apps with Network Extensions in their bundle had to be distributed through the Mac App Store, whereas apps with Endpoint Security extensions could not be distributed through the Mac App Store (or vice versa). I can no longer find language on such restrictions. Can I distribute an app with both a Network Extension and an Endpoint Security extension in the same app bundle via the Mac App Store?

I'm working with a security extension on macOs. There are cases where the extension identifies or blocks some user activity. I would like to post a notification to the user via UNUserNotificationCenter. The extension itself is not running in an app bundle and receives an error that the system cannot resolve the app bundle proxy. To work around this restriction, I have created a separate helper app that can accept arguments and post user notification messages. I can call that app directly and display notification message. If I spawn that app with NSTask from a test command like executable, the app will display notifications. If I perform the exact same spawn from the security extension, the app does not have authorization to display. The error message retrieved when requesting authorization is "Couldn't communicate with a helper application." This error is coming from inside my helper application that was already spawned by the security extension and is in context of requesting authorization to post a user notification to UNUserNotificationCenter. The user has already approved the app to display notifications, the only thing different is spawning the app from the extension. Calling it from the command line or finder works just fine. https://developer.apple.com/documentation/usernotifications/asking_permission_to_use_notifications Before I try alternative designs.. Does anyone have insight to what is preventing the connection to user notification center in one deployment and not the other?