Hello Apple Developer Community,
I am designing a security-isolated Swift compilation workflow on Apple silicon macOS. The goal is to execute a compiler only within an explicitly authorized environment, without granting access to unrelated project files or privileged operations.
I am investigating the Endpoint Security framework, specifically AUTH_EXEC, for enforcing execution authorization.
Security requirements:
- Allow only explicitly approved compiler and linker executables.
- Validate executable identity and command-line arguments, including child process execution.
- Prevent unauthorized execution even if the authorization component crashes, disconnects, or fails to respond before its deadline.
- Ensure that restrictions cannot be bypassed by launching a different executable or using unexpected child process arguments.
My understanding:
Endpoint Security provides execution authorization events and APIs for inspecting process arguments. However, Apple's documentation indicates that missing an authorization deadline may result in implicit authorization.
This raises an important question about enforcing a strictly fail-closed policy.
Questions:
- Is there a publicly supported macOS mechanism that guarantees unauthorized process execution remains blocked when an Endpoint Security client becomes unavailable or misses its authorization deadline?
- Can Endpoint Security be combined with App Sandbox, launch constraints, or another supported security mechanism to provide this guarantee?
- Is there a supported way to enforce restrictions on child process executable identity and command-line arguments before execution?
- If these guarantees are not available, what isolation architecture would Apple recommend for executing an untrusted or potentially misbehaving compiler?
Environment:
- Apple silicon Mac
- macOS 26.x
- Apple Swift 6.3.x
- Xcode and macOS SDK
- Local, non-privileged Swift compilation
This is an architectural design question. No Endpoint Security system extension or privileged helper has been deployed.
I would appreciate guidance on publicly supported APIs, security guarantees, and any relevant Apple documentation.
Thank you!