Running CryptoTokenKit as security agent

Question

Remark42 OP

Created 1w

Replies 4

Boosts 0

Participants 2

Hi,

when creating a CryptoTokenKit extension according to https://developer.apple.com/documentation/cryptotokenkit/authenticating-users-with-a-cryptographic-token, it is neccessary to register it under the securityagent in order to make the CTK usable before login. i.e. we want to run

sudo -u _securityagent /Applications/HostApp.app/Contents/MacOS/HostApp

However, even with the empty application the command fails with illegal hardware instruction sudo -u _securityagent /Applications/HostApp.app/Contents/MacOS/HostApp

I see that it always crashes when the HostApp is sandboxed, but it does not work even without sandboxing (i am sharing the error report message below).

i actually noticed that when the HostApp is sandboxed and I run the above command, the extension starts to be usable even before login, even though i see the HostApp crash. The same does not happen without the sandbox

So I am curious how to in fact properly register the CTK extension under security agent? Also am not sure how to unregister it from the _securityagent

thank you for your help

Version: 1.0 (1) Code Type: X86-64 (Native) Parent Process: Exited process [9395] Responsible: Terminal [399] User ID: 92

Date/Time: 2025-03-21 18:54:03.0684 +0100 OS Version: macOS 15.3.2 (24D81) Report Version: 12 Bridge OS Version: 9.3 (22P3060) Anonymous UUID: 41F9918C-5BCA-01C7-59C2-3E8CFC3F8653

Sleep/Wake UUID: 8AB66C75-3C32-41D4-9BD4-887B0FB468FE

Time Awake Since Boot: 4300 seconds Time Since Wake: 1369 seconds

System Integrity Protection: enabled

Crashed Thread: 0 Dispatch queue: WMClientWindowManager

Exception Type: EXC_BAD_INSTRUCTION (SIGILL) Exception Codes: 0x0000000000000001, 0x0000000000000000

Termination Reason: Namespace SIGNAL, Code 4 Illegal instruction: 4 Terminating Process: exc handler [9396]

Application Specific Signatures: API Misuse

Thread 0 Crashed:: Dispatch 0 libxpc.dylib 1 libxpc.dylib 2 WindowManagement 3 WindowManagement 4 WindowManagement 5 libdispatch.dylib 6 libdispatch.dylib 7 WindowManagement 8 AppKit 9 libdispatch.dylib 10 libdispatch.dylib 11 AppKit 12 AppKit 13 AppKit 14 AppKit 15 SwiftUI 16 SwiftUI 17 SwiftUI 18 SwiftUI 19 SwiftUI 20 SwiftUI 21 SwiftUI 22 SwiftUICore 23 SwiftUICore 24 SwiftUI 25 SwiftUI 26 AppKit 27 AppKit 28 AppKit 29 AppKit 30 AppKit 31 AppKit 32 AppKit 33 AppKit 34 Foundation 35 Foundation 36 AE 37 AE 38 AE 39 HIToolbox 40 AppKit 41 AppKit 42 AppKit 43 AppKit 44 SwiftUI 45 SwiftUI 46 SwiftUI 47 Crescendo CryptoTokenKit 48 Crescendo CryptoTokenKit 49 dyld queue: WMClientWindowManager 0x7ff80667b2bd _xpc_api_misuse + 113 0x7ff80665f0e4 xpc_connection_set_target_uid + 187 0x7ffd0b946693 -[WMClientWindowManager _createXPCConnection] + 1011 0x7ffd0b947361 -[WMClientWindowManager _xpcConnection] + 65 0x7ffd0b9447c9 __31-[WMClientWindowManager stages]_block_invoke + 41 0x7ff8067af7e2 _dispatch_client_callout + 8 0x7ff8067bca2c _dispatch_lane_barrier_sync_invoke_and_complete + 60 0x7ffd0b9446fc -[WMClientWindowManager stages] + 268 0x7ff80b1fd0b7 __54-[NSWMWindowCoordinator initializeStageFramesIfNeeded]_block_invoke + 30 0x7ff8067af7e2 _dispatch_client_callout + 8 0x7ff8067b0aa2 _dispatch_once_callout + 20 0x7ff80b1fd060 -[NSWMWindowCoordinator initializeStageFramesIfNeeded] + 296 0x7ff80a3b3701 -[NSWindow _commonInitFrame:styleMask:backing:defer:] + 888 0x7ff80a3b2f77 -[NSWindow _initContent:styleMask:backing:defer:contentView:] + 1222 0x7ff80a3b2aa9 -[NSWindow initWithContentRect:styleMask:backing:defer:] + 42 0x7ff917f321e0 0x7ff91776f000 + 8139232 0x7ff917a8e2f2 0x7ff91776f000 + 3273458 0x7ff917bccfba 0x7ff91776f000 + 4579258 0x7ff917f2ca8e 0x7ff91776f000 + 8116878 0x7ff917f24a65 0x7ff91776f000 + 8084069 0x7ff917f21540 0x7ff91776f000 + 8070464 0x7ff91849e9f1 0x7ff91776f000 + 13826545 0x7ffb13103ea5 0x7ffb12c81000 + 4730533 0x7ffb13102e0f 0x7ffb12c81000 + 4726287 0x7ff91849e903 0x7ff91776f000 + 13826307 0x7ff91849bc1c 0x7ff91776f000 + 13814812 0x7ff80a54f191 -[NSApplication _doOpenUntitled] + 422 0x7ff80a4efc59 __58-[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:]_block_invoke + 237 0x7ff80a963818 __102-[NSApplication _reopenWindowsAsNecessaryIncludingRestorableState:withFullFidelity:completionHandler:]_block_invoke + 101 0x7ff80a4ef6fa __97-[NSDocumentController(NSInternal) _autoreopenDocumentsIgnoringExpendable:withCompletionHandler:]_block_invoke_3 + 148 0x7ff80a4eee8f -[NSDocumentController(NSInternal) _autoreopenDocumentsIgnoringExpendable:withCompletionHandler:] + 635 0x7ff80a96373d -[NSApplication _reopenWindowsAsNecessaryIncludingRestorableState:withFullFidelity:completionHandler:] + 269 0x7ff80a3a6259 -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 529 0x7ff80a3a5eb9 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 679 0x7ff807a4b471 -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 307 0x7ff807a4b285 _NSAppleEventManagerGenericHandler + 80 0x7ff80e0e4e95 0x7ff80e0da000 + 44693 0x7ff80e0e4723 0x7ff80e0da000 + 42787 0x7ff80e0de028 aeProcessAppleEvent + 409 0x7ff81217b836 AEProcessAppleEvent + 55 0x7ff80a39ee6a _DPSNextEvent + 1725 0x7ff80adf38b8 -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1290 0x7ff80a38faa9 -[NSApplication run] + 610 0x7ff80a362d34 NSApplicationMain + 823 0x7ff9177a7da1 0x7ff91776f000 + 232865 0x7ff917af0d40 0x7ff91776f000 + 3677504 0x7ff917d8fef8 0x7ff91776f000 + 6426360 0x10b1baf6e static HostApp.$main() + 30 0x10b1bd2f9 main + 9 (HostApp.swift:24) 0x7ff8065c82cd start + 1805

Answered by DTS Engineer in 830690022

Written by Remark42 in 777483021

Also am not sure how to unregister it from the _securityagent

There’s no specific mechanism to do that. Keep in mind that you’re not explicitly registering your extension here, but rather your making it known to Launch Services. Launch Services has a bunch of logic to clean up its database in response to file system changes, for example, when an app gets deleted.

Coming back to your crash, that’s happening because you’re starting an entire GUI stack in the odd execution context created by sudo -u _securityagent. Pasted in below you’ll find my explanation of this issue and a workaround.

ps I’m using the correct terminology here. The CTK docs say host app when they mean container app. In the app extension world, the host app is the app that uses the extension services, which in this case is loginwindow.

pps When posting preformatted text, it’s best to code block. See Quinn’s Top Ten DevForums Tips for this and other tips.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

 class MacAppDelegate: NSObject, NSApplicationDelegate {
 
    /// Terminates the app immediately on launch if the `shouldQuitImmediately`
    /// default is set.
    ///
    /// If you’re building a smart card token and want to use it to authenticate a
    /// user at login time, you must apply the ~~hack~~ workaround described in the
    /// [Register the Extension with SecurityAgent][ref] section of *Authenticating
    /// Users with a Cryptographic Token*.  The doc says:
    ///
    /// _The ~~hosting~~ container app may in fact do nothing more than exit
    /// cleanly_
    ///
    /// but doesn’t describe how to go about that.  It turns out that:
    ///
    /// * If you don’t do anything, your container app will crash as it tries to
    ///   bring up a graphical UI.
    ///
    /// * OTOH, if your app does _nothing_ at launch — for example, if you move
    ///   this check to your `main` function — that’s not sufficient to register
    ///   it with Launch Services.
    ///
    /// [ref]: <https://developer.apple.com/documentation/cryptotokenkit/authenticating_users_with_a_cryptographic_token#2937138>
    ///
    /// This code threads that needle.  It’s implemented in a delegate method
    /// that’s called after the app has started running but before it puts up
    /// any UI.  On the systems I tested it with — primarily macOS 13 — that’s
    /// far enough to update the Launch Services registration but not so far as
    /// to trigger a crash. The code then checks for the `shouldQuitImmediately`
    /// user default and, if it’s set, exits the process.
    ///
    /// To see this an action, run the app like so:
    ///
    /// ```shell
    /// % sudo -u _securityagent /Applications/MyApp.app/Contents/MacOS/MyApp -shouldQuitImmediately YES
    /// ```
    ///
    /// The app will quit immediately with a helpful message.
 
    func applicationWillFinishLaunching(_ notification: Notification) {
        if UserDefaults.standard.bool(forKey: "shouldQuitImmediately") {
            print("Quitting immediately because `shouldQuitImmediately` was set.")
            exit(0)
        }
    }
    
    … other stuff …
}

Boost

Answer 1

DTS Engineer OP

Apple

5d

Accepted Answer

Recommended

Written by Remark42 in 777483021

Also am not sure how to unregister it from the _securityagent

There’s no specific mechanism to do that. Keep in mind that you’re not explicitly registering your extension here, but rather your making it known to Launch Services. Launch Services has a bunch of logic to clean up its database in response to file system changes, for example, when an app gets deleted.

Coming back to your crash, that’s happening because you’re starting an entire GUI stack in the odd execution context created by sudo -u _securityagent. Pasted in below you’ll find my explanation of this issue and a workaround.

ps I’m using the correct terminology here. The CTK docs say host app when they mean container app. In the app extension world, the host app is the app that uses the extension services, which in this case is loginwindow.

pps When posting preformatted text, it’s best to code block. See Quinn’s Top Ten DevForums Tips for this and other tips.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

 class MacAppDelegate: NSObject, NSApplicationDelegate {
 
    /// Terminates the app immediately on launch if the `shouldQuitImmediately`
    /// default is set.
    ///
    /// If you’re building a smart card token and want to use it to authenticate a
    /// user at login time, you must apply the ~~hack~~ workaround described in the
    /// [Register the Extension with SecurityAgent][ref] section of *Authenticating
    /// Users with a Cryptographic Token*.  The doc says:
    ///
    /// _The ~~hosting~~ container app may in fact do nothing more than exit
    /// cleanly_
    ///
    /// but doesn’t describe how to go about that.  It turns out that:
    ///
    /// * If you don’t do anything, your container app will crash as it tries to
    ///   bring up a graphical UI.
    ///
    /// * OTOH, if your app does _nothing_ at launch — for example, if you move
    ///   this check to your `main` function — that’s not sufficient to register
    ///   it with Launch Services.
    ///
    /// [ref]: <https://developer.apple.com/documentation/cryptotokenkit/authenticating_users_with_a_cryptographic_token#2937138>
    ///
    /// This code threads that needle.  It’s implemented in a delegate method
    /// that’s called after the app has started running but before it puts up
    /// any UI.  On the systems I tested it with — primarily macOS 13 — that’s
    /// far enough to update the Launch Services registration but not so far as
    /// to trigger a crash. The code then checks for the `shouldQuitImmediately`
    /// user default and, if it’s set, exits the process.
    ///
    /// To see this an action, run the app like so:
    ///
    /// ```shell
    /// % sudo -u _securityagent /Applications/MyApp.app/Contents/MacOS/MyApp -shouldQuitImmediately YES
    /// ```
    ///
    /// The app will quit immediately with a helpful message.
 
    func applicationWillFinishLaunching(_ notification: Notification) {
        if UserDefaults.standard.bool(forKey: "shouldQuitImmediately") {
            print("Quitting immediately because `shouldQuitImmediately` was set.")
            exit(0)
        }
    }
    
    … other stuff …
}

1

Answer 2

Remark42 OP

4d

Thanks for your feedback. Can i ask more about the registeration process for the CTK extension?

Am i supposed to even use the securityagent approach? It does not seem to be working very well (anymore)... see e.g. https://github.com/frankmorgner/OpenSCToken/issues/37

is there some other way to enable the extension before login? e.g. after restart? For example the built-in PIV CTK extension works well.

0

Answer 3

Remark42 OP

4d

Forgot to mention that the trick with applicationWillFinishLaunching works nicely to avoid crashes when registering as securityagent. However my CTK extension is still ignored by the logon screen after restarting the machine

0

Answer 4

Remark42 OP

4d

I make it work in the end. I guess the launch services were in some undesired state. After running restarting them according to

https://discussions.apple.com/thread/251735453?sortBy=rank

the registration process started working.

Thank you!

0

	class MacAppDelegate: NSObject, NSApplicationDelegate {

	/// Terminates the app immediately on launch if the `shouldQuitImmediately`
	/// default is set.
	///
	/// If you’re building a smart card token and want to use it to authenticate a
	/// user at login time, you must apply the ~~hack~~ workaround described in the
	/// [Register the Extension with SecurityAgent][ref] section of *Authenticating
	/// Users with a Cryptographic Token*. The doc says:
	///
	/// _The ~~hosting~~ container app may in fact do nothing more than exit
	/// cleanly_
	///
	/// but doesn’t describe how to go about that. It turns out that:
	///
	/// * If you don’t do anything, your container app will crash as it tries to
	/// bring up a graphical UI.
	///
	/// * OTOH, if your app does _nothing_ at launch — for example, if you move
	/// this check to your `main` function — that’s not sufficient to register
	/// it with Launch Services.
	///
	/// [ref]: <https://developer.apple.com/documentation/cryptotokenkit/authenticating_users_with_a_cryptographic_token#2937138>
	///
	/// This code threads that needle. It’s implemented in a delegate method
	/// that’s called after the app has started running but before it puts up
	/// any UI. On the systems I tested it with — primarily macOS 13 — that’s
	/// far enough to update the Launch Services registration but not so far as
	/// to trigger a crash. The code then checks for the `shouldQuitImmediately`
	/// user default and, if it’s set, exits the process.
	///
	/// To see this an action, run the app like so:
	///
	/// ```shell
	/// % sudo -u _securityagent /Applications/MyApp.app/Contents/MacOS/MyApp -shouldQuitImmediately YES
	/// ```
	///
	/// The app will quit immediately with a helpful message.

	func applicationWillFinishLaunching(_ notification: Notification) {
	if UserDefaults.standard.bool(forKey: "shouldQuitImmediately") {
	print("Quitting immediately because `shouldQuitImmediately` was set.")
	exit(0)
	}
	}

	… other stuff …
	}