Post not yet marked as solved
Hello!
I am using macOS Catalina, Xcode 11. I just started working on app development and this is my first project. Every time i try to simulate the code the program crashes and it gives me thread 1 signal SIGTERM error. My code is very simple, I don't think i have an error there. I am really stuck, I tried to run different projects but it doesn’t work on any of them. Please, can someone help me fix this error?
Thanks in advance!
Post not yet marked as solved
Hi,
I’d like to perform client-side certificate authentication from https based connection in macOS.
I’m using the method didReceiveChallenge from URLSession. However, I cannot read the keychain directly since my process is running as Daemon, and my client certificate reside in login keychain.
So I've followed the guidance from this question https://developer.apple.com/forums/thread/106851, and sent this authentication request to a user-based process which is running in the current user so it has access to the keychain.
After I acquire the NSURLCredential object, I’d like to return it back to the Daemon, so it may run the completionHandler with that credential.
However, After I successfully create the NSURLCredential in the user process, and send it back using some reply callback. It looks like the object didn’t serialized properly and I get the following error :
Exception: decodeObjectForKey: Object of class "NSURLCredential" returned nil from -initWithCoder: while being decoded for key <no key>
Here’s my client side code ( I made sure that the server side create a valid NSURLCredential object).
and the problem occur after I send the XPC request, right when i’m about to get the callback response (reply)
- (void)URLSession:(NSURLSession *)session
didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler {
if (challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodClientCertificate) {
[myXpcService getCertIdentityWithAcceptedIssuers:challenge.protectionSpace.distinguishedNames
withReply:^(NSURLCredential *cred, NSError *error) {
if (error != nil) {
completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
} else {
completionHandler(NSURLSessionAuthChallengeUseCredential, cred);
}
}];
}
Perhaps anybody can tell me what did I do wrong here ? Does XPC is capable to pass complex objects like NSURLCredentials ?
thanks !
Post not yet marked as solved
We'd prefer our security application not be worked around by the complex task of typing sudo launchctl unload /Library/LaunchDaemons/foo.plist 😄. Is there a way to prevent that? (We're not using ServiceManagement because we need ot control some of the plist entries, sadly.)
Post not yet marked as solved
XPC connection keeps getting interrupted.
I'm creating an xpc endpoint in FxPlug plugin for FCP X using xpc_endpoint_create.
This endpoint is then passed to a helper mach service running in the background and stored there.
Next, our main application is launched and retrieves the stored endpoint from the helper service.
It creates the communication channel using xpc_connection_create_from_endpoint
The main application communicates with FxPlug plugin using that endpoint.
It all works well when I am debugging either our application or FxPlug.
The moment I use the release build on both, the connection works fine for a while but is very quickly interrupted (usually 2-10 seconds), FxPlug plugin gets flagged as non-responsive and is unloaded by FCP X. This behavior is erratic and may cease after some time on some machines.
We've been working on this and some other issues with FxPlug team for months and some changes have been made, but we're stuck with that one last bit.
I want to stress the following: when I use a debug version of either plugin or our app, everything works fine, fxplug is never unloaded or marked as unresponsive, the connection is stable. When both components are using release builds, it all comes apart for no apparent reason.
Both plugin and application can normally recover and reconnect after being unloaded and restored.
Any thoughts on why an xpc connection would be interrupted in this way?
Post not yet marked as solved
What is Error Domain=com.apple.photos.error Code=46104 mean?
This error appears when I try to create an album on iOS14.
case:
User first gives AddOnly authorization and then gives ReadWrite authorization.
After I get the ReadWrite authorization, create an album.
code reference:
[[PHPhotoLibrary sharedPhotoLibrary] performChanges:^{
PHAssetCollectionChangeRequest *request = [PHAssetCollectionChangeRequest creationRequestForAssetCollectionWithTitle:albumName]
albumPlaceholder = [request placeholderForCreatedAssetCollection];
} completionHandler:^(BOOL success, NSError * _Nullable error) {
// success is NO, error is "Error Domain=com.apple.photos.error Code=46104"
}];
The supplementary log information for the above question is as follows:
2020-08-17 11:28:19.470871+0800 XXXX[4255:1139139] CoreData: XPC: Unable to connect to server with options { NSXPCStoreServerEndpointFactory = "<PLXPCPhotoLibraryStoreEndpointFactory: 0x280ce8760>"; skipModelCheck = 1;}
2020-08-17 11:28:19.479533+0800 XXXX[4255:1139139] CoreData: XPC: Unable to load metadata: Error Domain=NSCocoaErrorDomain Code=134060 "关键数据出错。" UserInfo={Problem=Unable to send to server; failed after 8 attempts.}
2020-08-17 11:28:19.483149+0800 XXXXX[4255:1139139] [error] error: addPersistentStoreWithType:configuration:URL:options:error: returned error NSCocoaErrorDomain (134060)
CoreData: error: addPersistentStoreWithType:configuration:URL:options:error: returned error NSCocoaErrorDomain (134060)
CoreData: annotation: userInfo:CoreData: annotation: Problem : Unable to send to server; failed after 8 attempts.
CoreData: annotation: storeType: NSXPCStoreCoreData: annotation: configuration: (null)
CoreData: annotation: URL: file:///var/mobile/Media/PhotoData/Photos.sqlite
CoreData: annotation: options:
CoreData: annotation: NSXPCStoreServerEndpointFactory : <PLXPCPhotoLibraryStoreEndpointFactory: 0x280ce8760>CoreData: annotation: skipModelCheck : 1
2020-08-17 11:28:19.485049+0800 XXXXX[4255:1139139] [Generic] Failed to connect to XPC PhotoLibraryStore file:///var/mobile/Media/PhotoData/Photos.sqlite with options { NSXPCStoreServerEndpointFactory = "<PLXPCPhotoLibraryStoreEndpointFactory: 0x280ce8760>"; skipModelCheck = 1;}: Error Domain=NSCocoaErrorDomain Code=134060 "关键数据出错。" UserInfo={Problem=Unable to send to server; failed after 8 attempts.}
2020-08-17 11:28:19.485565+0800 XXXXX[4255:1139139] [Migration] Failed to configure PSC for library file:///var/mobile/Media/: Error Domain=NSCocoaErrorDomain Code=134060 "关键数据出错。" UserInfo={Problem=Unable to send to server; failed after 8 attempts.}
2020-08-17 11:28:19.485943+0800 XXXXX[4255:1139139] [LibraryBundle] Unable to create PLLibraryBundleLogInfo because PSC is nil
There is another problem. When saving the video, if the AddOnly permission is taken first and then the ReadWrite permission is taken, the performChanges method will freeze for more than 10 seconds before calling the completionHandler. The following is the log information:
[Generic] Failed to connect to XPC PhotoLibraryStore file:///var/mobile/Media/PhotoData/Photos.sqlite with options {
NSXPCStoreServerEndpointFactory = "<PLXPCPhotoLibraryStoreEndpointFactory: 0x280700d00>";
These problems only occur during a cold launch when the AddOnly permission is taken first and then the ReadWrite permission is taken. Whether the app only takes the AddOnly permission, only takes the ReadWrite permission, or closes the app after authorization and reopens it will not happen.
Post not yet marked as solved
I am trying to pass an array of C-structs to an XPC Service, but the service receives only the first element. Following is the C struct
struct MyStruct
{
char *name;
unsigned char v1;
unsigned char v2;
Status status; // a c-style enum
};
and I am using it like this
struct MyStruct structs[3] = {{"name1", 0, 0, success}, {"name2", 1,1, success}, {0}};
[[_connectionToService remoteObjectProxy] doSomething:structs];
and doSomething is declared as
- (void)doSomething: (struct MyStruct[]) structs;
The document Creating XPC Services mentions that C structures and arrays containing only the types listed above are supported, but I am unable to get it to work even for an array of c-strings or ints.
Also, there's an API for making synchronous RPC calls but there is no documentation available for it.
- (id)synchronousRemoteObjectProxyWithErrorHandler:(void (^)(NSError *error))handler
It does seem to block but only if the remote method has a reply block. Is this the expected behaviour? And is it safe to cache the proxy object returned by this method?
Post not yet marked as solved
Hi,
Greetings for the day!
We would like to update you that we have created Content Filter NetworkExtension and this extension is working fine till Big Sur M1 however we are facing some strange problem in M1 Monterey. Intermittently, When we try to browse websites, it does not respond and after 3-5 minutes its opened the websites correctly.
We would like to update you that our subclass overrides handleNewFlow, handleInboundDataFromFlow, handleOutboundDataFromFlow, handleInboundDataCompleteForFlow and handleOutboundDataCompleteForFlow. In all these methods we first check whether NEFilterFlow is nil or not and then pauseVerdict and once asynchronous methods completes execution then we call resumeFlow with verdict (allowVerdict/dropVerdict).
When above mentioned issue generated we collected console streaming log and found these lines in the logs (Not from our application):
Ignoring resume command for flow 3c8faf3c4a9f7 which does not exist
Ignoring resume command for flow 3c90795d4d6f9 which does not exist
Ignoring resume command for flow 3c9086d1ede69 which does not exist
Ignoring resume command for flow 3c909b251d53b which does not exist
We are not sure how above line get printed because we don’t have this logs in our source code so we would need your help to understand this problem and resolution so that we can solve this issue.
We have couple of extra queries:
What is flow mentioned in above logs in bold text? Is it NEFilterFlow's identifier or something else?
How we can validate whether NEFilterFlow is valid or not before calling resumeFlow
Why above line is getting printed in log which says flow does not exist.
Is there any timeout maintained by NetworkExtension?
We are using XPC for interprocess communication so our question is that, Is NetworkExtension/XPC maintain the queue size and if it overflow the size then above line is getting printed. If this is the case then how we can handle that?
Is it known issue in NetworkExtension framework itself on M1 Monterey?
Thanks & Regards,
Mohmad Vasim
Hi,
I'm developing an macOS app which includes an agent (registered as login item) which is intended to run for entire duration of user's login session.
The agent's bundle also includes few application extensions. The application is intended to be distributed outside of App Store. It is not going to be sandboxed but rather notarized, so I'm using hardened runtime.
I want to add some application extensions (for example: a file provider etension) to be bundled with the agent.
The extensions are sandboxed and belong to the same application group as main application and the agent.
Extensions should do some IPC calls on the running agent process.
I think the most convenient solution for the IPC would be to use the XPC service, so, in the agent, I'am creating an XPC listener registered to mach service name.
Now I want to connect to the XPC service provided by the agent from the app extensions. This, however, fails with the following error:
Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named abcd.service was invalidated: failed at lookup with error 159 - Sandbox restriction."
My application bundle has now the following structure:
MainApp.app --- main application bundle (hardened runtime)
Contents/Library/LoginItems/agent.app --- agent with XPC service (hardened runtime)
.../agent.app/Contents/PlugIns/AppExt1.appex --- app extension 1 (sandboxed)
.../agent.app/Contents/Plugins/AppExt2.appex --- app extension 2 (sandboxed)
Searching through the forum I've found another post, which advises to bundle the XPC service within the app extension to mitigate this issue. This, however, does not seem like a viable solution for my problem: what I need is to call the code on the running agent instance.
As an alternative I considered to create a unix domain socket in the application group container and use that for communication between the agent and its extensions. XPC however is more convenient so if there is any way to make it working for the above scenario, I would be interested to learn about it.
Post not yet marked as solved
I am building a somewhat-VPN-like system. I have a daemon that handles the networking and a couple of agents that interact with the logged-in user. The daemon and agent communicate via XPC.
I am trying to get this to work "smoothly" with fast-user-switching. Empirically, I find that the daemon can correlate XPC connection from different agents in the different login sessions via xpc_connection_get_asid(), which appears to be equivalent to the security session id, though it's not clear this this equivalence is always they case, nor will always be the case in the future. If I had a way to get the security session id for a pid, I would use xpc_connection_get_pid()
When the daemon gets a network connection I want to find the pid the connection is coming from (it can only be from the local machine) and figure out which security session that pid belongs to so that I can direct any necessary user interaction and permission checking to the agent in the security session from which the network request is coming. Finding the pid from the TCP port is arduous and inefficient, but doable. However, once I've found the pid, I don't know how to determine the security session id (or audit session id) that that pid is part of.
GetSessionInfo appears to permit me to get information about my own session id including my session id, or additional info about another session, if I already have that session id.
For my purposes, a viable alternative to being able to get the security session for a pid might be to be able to ask the question "Is this pid part of this security session?" since I expect to have agents in a small number of security sessions.
Getting the username of the pid is obviously doable, however this would mean that I would be unable to determine where a sudo'ed process was coming from (at least not without walking up the parent heirarchy). This feels dicey.
Am I missing something?
Post not yet marked as solved
Hi,
I'm writing an XPC Service hosted in a container app.
This service is expected to trigger IPC when some URL of interest become reachable. I'm using SCNetworkReachability (Reachability class provided as sample code from Apple).
The reachability notification runs fine when running from the container app.
However the XPC Service is never triggered of any network change.
I'm suspecting something related to RunLoop or RunLoopMode (XPCListener is instantiated with serviceListener) but cannot find any fix.
I disabled sandboxing without success (and anyway it runs fine with sandboxed container + network client entitlement).
Any suggestion ?
Post not yet marked as solved
This specifically seems to happen when my network extension is spawned by launchd, but has not actually been connected. (That is my conclusion based on the evidence: ps shows the process existing, but the logs show that main() hasn't run yet, let alone the proxy provider's init(). Without being able to debug launchd, I would say the situation is that launchd has said "yes this XPC port exists, when you try to connect to it I will send it on over to the extension, and thereafter you two will happily communicate directly," but the process hasn't gotten around to accepting XPC connections.) This seems to be most likely to happen when the extension crashes, or I kill -9 it to see how it handles respawning.
I have a little CLI tool that talks (over XPC, of course) to the extension, mainly to say "Hi are you alive?" If the extension is not loaded, the XPC connection fails, as expected, and my tool says "NOT YET." If it is loaded and running, the XPC connection succeeds, as expected, and I get back a response of true.
So my first question is: is this expected behaviour?
My second question is: is there a way to do an XPC connection with a timeout?
Post not yet marked as solved
I'm trying to build something wherein I can redirect all traffic from a given application to a specified network interface. As an example use case, because I'm stuck with DSL for the time being, I don't want to saturate my line uploading every day things like dropbox or whatnot, so I want to be able to say, all traffic from dropbox should go through the wifi/personal hotspot. I can do this somewhat with squidproxy and specifying each application to go through that proxy -- but that relies on the app even allowing that kind of configuration and it's more work than I think it needs to be.
As an example of the same concept but for audio, see SoundSource by https://rogueamoeba.com/
With soundsource you can direct audio per application to any interface. I want to do the same, but for network traffic. Bonus I can get granular enough to direct outgoing and incoming to different devices on the same app.
But this is an area of systems programming I always felt the least accessible and I'm not really sure where to start reading.
First, I guess I should ask, is this even possible with macos/darwin at this time? I know in linux I could just namespace each application, but as far as I know, macos lacks that kind of functionality.
Cheers
Post not yet marked as solved
An application I am working on (Mostly swift 4.2 with sprinklings of C and C++) appears to be leaking mach ports when run on Mojave and currently has 3,600 open after running for 12 hours. I am just looking at the 'Ports' field in Activity Monitor to see this.The same binary running on Sierra is using about 500 ports.The application is quite complex, making extensive use of DispatchQueue() and also has an associated privileged helper.Unfortunately, I have been unable to create a simple test case that demonstrates the behaviour.I have done a lot of searching to find out what may be causing the problem and come up with zilch. Is there any debugging tool (i.e. Instruments plugin maybe) that might help to narrow down where the allocation/leakage is coming from. I have seen the results of the tests on google Chrome from a few years back but I'm not keen to start building, installing and debugging kernel extensions to track this problem down.
Post not yet marked as solved
Hi all,
I am having a mysterious problem trying to load a user LaunchAgent under Big Sur - It is the .plist of gniemetz's automount.sh https://github.com/gniemetz/automount
for mounting SMB shares via pwd access from the Keychain -
Placed the .sh into /usr/local/bin, chmod 644 and chown user:staff
Placed the LaunchAgent .plist into ~/Library/LaunchAgents (created LaunchAgents it as it didn't exist), same chmod/chown.
drwxr-xr-x&#9;&#9;3&#9; users&#9;&#9; 96 Nov&#9;1 22:13 LaunchAgents
~/Library/LaunchAgentsrw-r--r--&#9;&#9;1&#9; users&#9; 1038 Nov&#9;1 22:13 it.niemetz.automount.plist
/usr/local
drwxr-xr-x&#9;&#9;4 root&#9;&#9;wheel&#9;&#9;128 Nov&#9;1 21:52 bin
/usr/local/binrwxr-xr-x&#9;&#9;1 root&#9;&#9;wheel&#9;30310 Oct 29 21:58 automount.sh
then the following:
Load failed: 5: Input/output error
For the life of me, I cannot find anywhere what this means...
launchctl start ~/Library/LaunchAgents/it.niemetz.automount.plist
completes with no errors, syntax also parses OK
/Users//Library/LaunchAgents/it.niemetz.automount.plist: OK
I have added Terminal and /bin/bash to Full Disk Access under Security...
Launching the script manually as /usr/local/bin/automount.sh works fine.
Console shows
system.log shows this when load -w is run:
00:27:14 mac-mini-Big-Sur com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.1000002.100006.Aqua): entering bootstrap mode
Nov&#9;3 00:27:14 mac-mini-Big-Sur com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.1000002.100006.Aqua): exiting bootstrap mode
For easy reference the .plist is pasted at the end -
Anyone seen this error before?
Thanks!
++
Label
it.niemetz.automount
LimitLoadToSessionType
Aqua
RunAtLoad
WatchPaths
/etc/resolv.conf
/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist
/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
ProgramArguments
/usr/local/bin/automount.sh
--mountall
Unless I'm missing something (always possible)... there is no way to tell if you get a valid proxy back -- the error handler is asynchronous, and I don't see a way to say "this proxy is valid."
Am I missing something?
I have a few questions regarding daemons. Indeed, even the macos developer center has limited information resources.
I want to develop an application daemon that runs after system boot without login.
a) a Daemon; Is it a simple console application combined with a plist? Because there are almost no tutorials on daemon development related to xcode. If there is a code sample reference, can you share it here?
b) Can daemons be downloaded from the app store? Because there must be a software that I can offer to everyone through the app store. Is the installation automatic like other app store apps? If anyone has experience and can share it, I would be very grateful.
c) I am working on an api related to mirroring the screen to android phone. Do you think a daemon has full access to wifi/ble and screen capture APIs?
I would be very happy to hear your suggestions.
Post not yet marked as solved
Is it possible we embed a windowcontroller inside an XPC module and pop/hide the window as demanded? right now the window cannot pop due to not in main thread.
What is the better alternative under the condition that xpc cannot modify the caller for permission.
Post not yet marked as solved
Hi,A cross-platform plugin architecture we developed needs to load libraries at runtime from arbitrary locations (within our plugins).On MacOS, dynamic library loading fails to find/use a dependency that was already loaded, despite the library "install-name" matching. The same technique works on Linux for a library "SONAME" and on Windows based on the DLL filename, however, on Mac, it seems like the dependency is not resolved, unless it is also on a path of library locations (eg. DYLD_LIBRARY_PATH).Am I missing the proper technique to achieve the desired behavior? Is this the expected behavior on Mac or an issue in dlopen resolving dependencies?For example:dlopen(/Users/craig/KayakSDK/Plugins/ca.digitalrapids.CommonMedia/bin/OS_X/libCommonMedia.dylib, 1): Library not loaded: libKayakNative.dylib Referenced from: /Users/craig/KayakSDK/Plugins/ca.digitalrapids.CommonMedia/bin/OS_X/libCommonMedia.dylib Reason: image not foundBut libKayakNative.dylib had already been loaded and has the expected "install-name".$ otool -D Plugins/ca.digitalrapids.KayakCore/bin/OS_X/libKayakNative.dylibPlugins/ca.digitalrapids.KayakCore/bin/OS_X/libKayakNative.dylib:libKayakNative.dylibSo why doesn't dlopen utilize the already loaded libKayakNative.dylib ? That's how SONAME on Linux works and the DLL name on Windows.If DYLD_LIBRARY_PATH specifies the folders within the plugins, then everything does load and execute fine. But this is far from ideal, as DYLD_LIBRARY_PATH would need to be configured ahead of launch, and cannot be modified at runtime by the application. If there was a way to modify DYLD_LIBRARY_PATH (or an equivalent) at runtime, that would work for us too.Thanks, any info is appreciated,Craig
Post not yet marked as solved
Hi All,I am unable to set environment variable DYLD_LIBRARY_PATH using launchctl command on El Captian. The below are the commands$ launchctl setenv DYLD_LIBRARY_PATH /Path/to/my/dynamic/libraries$ launchctl getenv DYLD_LIBRARY_PATHThe getenv does not print the path, it returns empty.Thanks,Rashmi
Hi,
I’m writing a network extension for macOS using the following pattern:
Network extension with ID com.company.app.extension
XPC Service with ID com.company.app.controller
Container app with ID com.company.app.container
First 2 are contained in the 3rd
All of 3 are sandboxed & share the same com.company.app AppGroup.
XPC Service uses network (client) entitlement to fetch settings & control the extension.
The app need to support managed preferences as well.
I read many posts in this forum, but I’m confused about using NSUserDefaults accross those processes.
Pb 1 - standardsUserDefaults vs initWithSuiteName
I noticed that to observe defaults using KVO I need to use initWithSuiteName:@"com.company.app" (or addSuiteName).
Observing standardsUserDefaults alone will never trigger any event. This is the first confusion because my understanding was that KVO observation wasn’t restrincted to suites.
Pb 2 - AppGroup ‘group.’ prefix
If I observe a suite named ‘com.company.app’ from the container app or XPC Service I get error : [User Defaults] Couldn't read values in CFPrefsManagedSource<> (Domain: com.company.app, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null), Contents Need Refresh: No): accessing preferences outside an application's container requires user-preference-read or file-read-data sandbox access
This can be fixed using ‘group.com.company.app’ suite (both in the code and AppGroup entitlement). However if I use the same AppGroup for extension it will fail loading with error code OSSystemExtensionErrorValidationFailed.
Checked the provisioning profiles, they all map to the same ID in Dev portal. Including the TeamID in the suite name will produce the same situation.
The only way to load the extension is to use AppGroup com.company.app. This again is confusing because Dev portal force the ‘group.’ prefix. I can’t figure out how to use the same suite name for all processes.
Pb 3 - Inter-process synchronisation
Based on previous conclusion the situation is both container & controller use AppGroup (TeamID).group.com.company.app and addSuiteNamed:@"group.com.company.app" for observing & updating the defaults.
Each process can observe its own defaults updates but they do not synchronize between container app and XPC Service.
This is the most frustating part. The documentation says:
NSUserDefaultsDidChangeNotification is posted whenever any user defaults changed within the current process, but is not posted when ubiquitous defaults change, or when an outside process changes defaults. Using key-value observing to register observers for the specific keys of interest will inform you of all updates, regardless of where they're from.
Did I missed some steps ?
begaimk.
