i can not run "pgrep" or "ps" in sandbox?

Question

ugurozy OP

Created 2w

Replies 2

Boosts 0

Participants 2

Hi. I'm trying to learn macOS app development. i'm trying to run unix commands:

     func execute(_ command: String) throws -> String {
        let process = Process()
        let pipe = Pipe()
        
        process.executableURL = URL(fileURLWithPath: "/bin/bash")
        process.arguments = ["-c", command]
        
        process.standardOutput = pipe
        // process.standardError
        
        try process.run()
        process.waitUntilExit()
        
        guard let data = try pipe.fileHandleForReading.readToEnd() else {
            throw CommandError.readError
        }
        
        guard let output = String(data: data, encoding: .utf8) else {
            throw CommandError.invalidData
        }
        
        process.waitUntilExit()
        
        guard process.terminationStatus == 0 else {
            throw CommandError.commandFailed(output)
        }
        
        return output
    }

when try to run "pgrep" in sandbox mode ON, i get:

sysmon request failed with error: sysmond service not found error. if i turn it off it works. i don't know what to do. anyone can help me out?

Answered by DTS Engineer in 829050022

When a sandboxed app spawns a child process, that process inherits the app’s sandbox. This is blocking ps from being able to do its job.

This isn’t surprising. The App Sandbox is meant to provide both security and privacy, and allowing your app to list all the processes on the system runs counter to that goal.

Two other notes:

Normally I encourage folks to use the APIs in <libproc.h> rather than running ps. Those APIs are also blocked by the App Sandbox, failing with EPERM.
Running child processes via Process is harder than it looks. Your code might deadlock if the output from ps is large. I show one way to avoid this in Running a Child Process with Standard Input and Output.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

2w

Accepted Answer

Recommended

When a sandboxed app spawns a child process, that process inherits the app’s sandbox. This is blocking ps from being able to do its job.

This isn’t surprising. The App Sandbox is meant to provide both security and privacy, and allowing your app to list all the processes on the system runs counter to that goal.

Two other notes:

Normally I encourage folks to use the APIs in <libproc.h> rather than running ps. Those APIs are also blocked by the App Sandbox, failing with EPERM.
Running child processes via Process is harder than it looks. Your code might deadlock if the output from ps is large. I show one way to avoid this in Running a Child Process with Standard Input and Output.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1

Answer 2

ugurozy OP

2w

Thank you

0

	func execute(_ command: String) throws -> String {
	let process = Process()
	let pipe = Pipe()

	process.executableURL = URL(fileURLWithPath: "/bin/bash")
	process.arguments = ["-c", command]

	process.standardOutput = pipe
	// process.standardError

	try process.run()
	process.waitUntilExit()

	guard let data = try pipe.fileHandleForReading.readToEnd() else {
	throw CommandError.readError
	}

	guard let output = String(data: data, encoding: .utf8) else {
	throw CommandError.invalidData
	}

	process.waitUntilExit()

	guard process.terminationStatus == 0 else {
	throw CommandError.commandFailed(output)
	}

	return output
	}