How to debug SecurityAgentPlugins?

Hi,

I’ve developed a custom Authorization Plugin and placed it under: /Library/Security/SecurityAgentPlugins/AuthPlugin.bundle

I also updated the corresponding right in the authorization database (authorizationdb) to point to my plugin’s mechanism.

However, when I invoke the right, my plugin does not get loaded. The system log shows the following errors:

AuthorizationHostHelper: Init: unable to load bundle executable for plugin: AuthPlugin.bundle
AuthorizationHostHelper: Processing request: Failed to create agent mechanism AuthPlugin:auth.startup.authenticate, failing authentication!

Here’s what I’ve verified so far:

The plugin bundle and its executable are signed and notarized successfully.

The executable inside the bundle is universal (arm64 + x86_64).

The bundle structure looks correct (Contents/Info.plist, Contents/MacOS/..., etc.).

Despite that, the plugin fails to load at runtime.

Could anyone provide advice on how to debug or trace why the SecurityAgent cannot load the bundle executable? Are there any entitlements, permissions, or SIP-related restrictions that might prevent custom authorization plugins from being loaded on modern macOS versions?

Thanks in advance for any insights!

The plugin bundle and its executable are signed and notarized successfully.

You’re plug-in doesn’t need to be notarised during development. In fact, I recommend that you not use Developer ID signing for day-to-day work. See The Care and Feeding of Developer ID.

Are there any entitlements … ?

No. Entitlements only make sense on a main executable, and plug-ins are not that.

Are there any … permissions … ?

Only the obvious ones. If you copy the plug-in /Library/Security/SecurityAgentPlugins/ using sudo cp, it’ll get the right permissions.

Are there any … SIP-related restrictions … ?

No.

This is almost certainly a problem with the way that your plug-in packaged. Are you able to load it with QAuthHostSimulator?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

How to debug SecurityAgentPlugins?
 
 
Q