I'm attempting to extract the environment variables from an es_event_exec_t
using the provided es_exec_env()
function, but when I attempt to do this for certain processes my security extension seems to crash:
Code Type: ARM-64 (Native) Parent Process: launchd [1] User ID: 0 OS Version: macOS 13.1 (22C65) System Integrity Protection: disabled Crashed Thread: 0 Dispatch queue: BBReaderQueue Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Thread 0 Crashed:: Dispatch queue: BBReaderQueue 0 libsystem_kernel.dylib 0x1938961b0 __pthread_kill + 8 1 libsystem_pthread.dylib 0x1938cccec pthread_kill + 288 2 libsystem_c.dylib 0x1938062c8 abort + 180 3 libsystem_c.dylib 0x193805620 __assert_rtn + 272 4 libEndpointSecurity.dylib 0x1a5518078 es_exec_env.cold.1 + 44 5 libEndpointSecurity.dylib 0x1a5515bf4 es_exec_env + 48 6 ESFramework 0x1015b443c parseExecEnvVars(event:) + 3084 (ExecEvent.swift:172)
Any ideas on what might be going wrong or where I might be able to start? I'm able to reproduce the problem by executing iTerm2.app
which kicks off iTermServer-3.4.19
causing the crash.
Here's the basic program flow:
- Receive incoming
es_message_t
and if it's an exec event - Create a new struct to model the exec event:
public struct ExecEvent: Identifiable, Codable, Hashable { public var id: UUID = UUID() public var process_path, env_variables: String? init(fromRawEvent rawEvent: UnsafePointer<es_message_t>) { es_retain_message(rawEvent) var execEvent: es_event_exec_t = rawEvent.pointee.event.exec self.process_path = String(cString: execEvent.target.pointee.executable.pointee.path.data) // MARK: Parse environment variables. Crashes for certain procs like `iTermServer-3.4.19`. self.env_variables = parseExecEnvVars(event: &execEvent) es_release_message(rawEvent) } }
To grab the environment variables
public func parseExecEnvVars(event: inout es_event_exec_t) -> String { let numberOfVars: Int = Int(es_exec_arg_count(&event)) let procPath: String = String(cString: event.target.pointee.executable.pointee.path.data) os_log("Path: \(procPath) --> has \(numberOfVars) env vars") var envVars: [String] = [] for index in 0..<numberOfVars { let envVarVar: String = String(cString: es_exec_env(&event, UInt32(index)).data) os_log("#\(index): \(envVarVar)") envVars.append(envVarVar) } return envVars.joined(separator: "\n") }