SMJobBless fails when called from an XPC Service.

Spot on! That was exactly it.

Thanks Quinn!

Hmmmm hold the phone, spoke to soon!

This worked, in that the XPC service is now able to present an interactive prompt for the password, and SMJobBless succeeds, but it still breaks when the main app is made to be sandboxed (which was the whole goal of this EBAS sample).

Here's what the logs have to say:

info	authd	Process /usr/libexec/smd (PID 788) evaluates 1 rights with flags 00000003 (engine 213): (
        "com.apple.ServiceManagement.blesshelper"
    )

debug	authd	engine 213: user not used password

debug	authd	engine 213: checking if rule com.apple.ServiceManagement.blesshelper contains password-only item

debug	authd	engine 213: _preevaluate_rule com.apple.ServiceManagement.blesshelper

error	authd	Sandbox denied authorizing right 'com.apple.ServiceManagement.blesshelper' for authorization created by '/MyApp.app/Contents/XPCServices/IntermediatorXPCService.xpc' [13471] (engine 213)

debug	authd	engine 213: authorize result: -60005

(-60005 is errAuthorizationDenied)

SMJobBless itself fails with The operation couldn’t be completed. (CFErrorDomainLaunchd error 4.)

This is another case where intuitively, this makes sense. The docs for JoinExistingSession say:

Boolean. Indicates that your service runs in the same security session as the caller. The default value is False, which indicates that the service is run in a new security session. Set the value to True if the service needs to access to the user’s keychain, the pasteboard, or other per-session resources and services.

If we're sharing the same security session, and the parent is made sandboxed, then how would it be possible for the XPC service to use the authorization services APIs, when the main app can't? I'm left stumped with how the EBAS makes this work.

If we're sharing the same security session, and the parent is made sandboxed, then how would it be possible for the XPC service to use the authorization services APIs, when the main app can't?

Security sessions are not directly related to the sandbox. A security session is set up when the user logs in, but you don’t get a new session when you launch a sandboxed app. You can confirm this with SessionGetInfo.

I'm left stumped with how the EBAS makes this work.

So, to be clear, you’ve built EBAS and it works? ’cause it’s possible that the EBAS code used to work back in the day but is failing on modern systems.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

A security session is set up when the user logs in, but you don’t get a new session when you launch a sandboxed app. You can confirm this with SessionGetInfo.

Indeed, it appears that every "regular app" is sharing the same security and audit sessions.

Here are some details about the security and audit sessions:

Without JoinExistingSession:

Main app:

My security session (id 100019) has attributes: [.sessionHasGraphicAccess, .sessionHasTTY])
My audit session (id 100019) and has flags: [AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS, AU_SESSION_FLAG_HAS_TTY, AU_SESSION_FLAG_HAS_CONSOLE_ACCESS, AU_SESSION_FLAG_HAS_AUTHENTICATED]

XPC Service:

My security session (id 103826) has attributes: [])
My audit session (id 103826) and has flags: []

With JoinExistingSession:

EBAS has these same flags, as well.

Main app:

My security session (id 100019) has attributes: [.sessionHasGraphicAccess, .sessionHasTTY])
My audit session (id 100019) and has flags: [AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS, AU_SESSION_FLAG_HAS_TTY, AU_SESSION_FLAG_HAS_CONSOLE_ACCESS]

XPC Service:

My security session (id 100019) has attributes: [.sessionHasGraphicAccess, .sessionHasTTY])
My audit session (id 100019) and has flags: [AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS, AU_SESSION_FLAG_HAS_TTY, AU_SESSION_FLAG_HAS_CONSOLE_ACCESS, AU_SESSION_FLAG_HAS_AUTHENTICATED]

Security and Audit session logging code

Here's the code I used to generate those messages, in case you're curious.

extension SessionAttributeBits: CaseIterable {
	public static var allCases: [SessionAttributeBits] {
		[
			.sessionIsRoot,
			.sessionHasGraphicAccess,
			.sessionHasTTY,
			.sessionIsRemote,
		]
	}
}

extension SessionAttributeBits: CustomStringConvertible {
	public var description: String {
		switch self {
			case .sessionIsRoot:			return ".sessionIsRoot"
			case .sessionHasGraphicAccess:	return ".sessionHasGraphicAccess"
			case .sessionHasTTY:			return ".sessionHasTTY"
			case .sessionIsRemote:			return ".sessionIsRemote"
			default: return Self.allCases.filter(self.contains).description
		}
	}
}

// Why isn't `audit_session_flags` imported as an OptionSet to begin with?
extension audit_session_flags: OptionSet {}

extension audit_session_flags: CaseIterable {
	public static var allCases: [audit_session_flags] {
		[
			AU_SESSION_FLAG_IS_INITIAL,
			AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS,
			AU_SESSION_FLAG_HAS_TTY,
			AU_SESSION_FLAG_IS_REMOTE,
			AU_SESSION_FLAG_HAS_CONSOLE_ACCESS,
			AU_SESSION_FLAG_HAS_AUTHENTICATED,
		]
	}
}

extension audit_session_flags: CustomStringConvertible {
	public var description: String {
		switch self {
			case AU_SESSION_FLAG_IS_INITIAL:			return "AU_SESSION_FLAG_IS_INITIAL"
			case AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS:	return "AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS"
			case AU_SESSION_FLAG_HAS_TTY:				return "AU_SESSION_FLAG_HAS_TTY"
			case AU_SESSION_FLAG_IS_REMOTE:				return "AU_SESSION_FLAG_IS_REMOTE"
			case AU_SESSION_FLAG_HAS_CONSOLE_ACCESS:	return "AU_SESSION_FLAG_HAS_CONSOLE_ACCESS"
			case AU_SESSION_FLAG_HAS_AUTHENTICATED:		return "AU_SESSION_FLAG_HAS_AUTHENTICATED"
			default: return Self.allCases.filter(self.contains).description
		}
	}
}

extension auditinfo_addr_t {
	static func forCurrentProcess() -> Self {
		var auditInfo = auditinfo_addr_t();
		let errorCode = getaudit_addr(&auditInfo, Int32(MemoryLayout.size(ofValue: auditInfo)))
		assert(errorCode == 0, "getaudit_addr returned a non-zero error code: \(errorCode)")
		return auditInfo
	}

	var auditSessionFlags: audit_session_flags {
		audit_session_flags(rawValue: UInt32(self.ai_flags))
	}
}

public func printSecuritySessionInfo() {
	var mySessionID = SecuritySessionId()
	var sessionAttributes = SessionAttributeBits()
	let errorCode = SessionGetInfo(callerSecuritySession, &mySessionID, &sessionAttributes)
	assert(errorCode == errSecSuccess)

	print("My security session (id \(mySessionID)) has attributes: \(sessionAttributes))")
}

public func printAuditSessionInfo() {
	let auditSession = auditinfo_addr_t.forCurrentProcess()
	print("My audit session (id \(auditSession.ai_asid)) and has flags: \(auditSession.auditSessionFlags)")
}