Hi,
I was trying to run a macOS VM under a launchd daemon as part of a requirement. The parent daemon spawns a macOS VM under root user. Sometimes this is fine, but sometimes I'm getting a security error from VZ library :
Unable to access security information. The virtual machine encountered a security error.
In system logs, I was able to see this :
ctkd: unable to generate key: error e00002e2 for com.apple.Virtualization.VirtualMachine with SepKey ACL
I think this indicates Virtualization.framework asked CryptoTokenKit/Secure Enclave to create a key, and the security subsystem rejected it in the current execution context.
Is it possible to run VM this way ? If yes, what am I missing ?
I was trying to run a macOS VM under a launchd daemon as part of a requirement.
This isn’t something I’d do. My standard sniff test for this [1] is to look at the framework’s imports:
% dyld_info -linked_dylibs /System/Library/Frameworks/Virtualization.framework/Versions/A/Virtualization
…
weak-link /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
…
Virtualization links with AppKit, which is obviously not daemon-safe.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] Something I talk about in the ancient, but still surprisingly relevant, TN2083 Daemons and Agents.
