General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

During a test run of my HomeKit application in Xcode, after some time the app did run smoothly, I've started for one characteristic to get a pretty weird error in the readValueWithCompletionHandler: callback block: Error Domain=HMErrorDomain Code=80 "Missing entitlement for API." UserInfo={NSLocalizedFailureReason=Handler does not support background access, NSLocalizedDescription=Missing entitlement for API.} The application was launched just a couple of hours ago and the profile is still OK (though it will expire very inconveniently soon): 1044 ocs /tmp> security cms -D -i /Users/ocs/Library/Developer/Xcode/DerivedData/HomeObserverNA-hkazqlfbeuucvybpdzdgosyhhxnx/Build/Products/Debug-maccatalyst/HomeObserverNA.app/Contents/embedded.provisionprofile -o /tmp/ppp.plist 1045 ocs /tmp> plutil -extract ExpirationDate raw -o - /tmp/ppp.plist 2026-10-15T14:04:02Z 1046 ocs /tmp> Note please that immediately after launch (and for some time after that) the value was read in through the same code without any problem. Strangely enough, when I've switched the device through the Home application, I've got the update planned through enableNotification:completionHandler: all right. and the error stopped occurring, readValueWithCompletionHandler: from that moment on again works as presumed. How can I fix the problem, what's wrong in my app? Thanks!

I'm trying to debug a problem that's affecting customers who have upgraded to WatchOS 10, and I'm unable to get any console output from the watch when I debug the watch app in Xcode, or from the console app connecting from my Mac. The other weird thing is that my watch shows up twice in the device list in the console app. Is this a known issue?

I am aware that for filenames, somewhere between the UI components and the kernel a conversion between / and : happens. Can someone explain where this happens? It is easy enough for me to convert ':' in kernel filenames to '/' in the string shown to or accepted from the user. But maybe there is an OS function I should be using to do that, in some more portable way, or something. More challenging is what to do when the user really wants a ':' in their filename. What is best practice? I was a bit surprised to find that in Finder, if I try to create a file called 'abc/def:ghi', I get a vague error message that tells me to "try with no punctuation marks". The case that has caused me to look into this now is a desire for filenames that are dates or times. From the user's point of view, a filename '8/10/2026 14:17:42' is not an unreasonable thing to ask for, is it? What other oddities are there? '.' and '..' of course... anything else?

Environment: macOS 26.6.2 (25G83) Xcode 26.6 (17F113) macOS command-line process Security.framework SessionGetInfo ASID obtained from the kernel-provided audit token in a received Mach message I’m implementing a security-sensitive Mach IPC receiver. The receiver obtains the sender’s audit token from the Mach message trailer and derives the sender PID, effective UID, and audit session ID (ASID). The sender executable identity is validated separately. Given the ASID, SessionGetInfo can successfully return the corresponding SecuritySessionId and session attributes. The question is about the freshness and synchronization semantics of that lookup. At the point where the receiver authorizes a request, can a successful SessionGetInfo(asid, ...) result be treated as authoritative evidence that the corresponding login/audit session is still currently valid? In particular: What happens if the session logs out, terminates, or is revoked concurrently with the lookup? Can SessionGetInfo successfully return information for a session that is no longer current due to caching or propagation delay? Are there documented ordering or synchronization guarantees between session termination and subsequent SessionGetInfo calls from another process? Can the lookup block for an unbounded period if the underlying security service is unavailable? Is there a supported timeout or cancellation mechanism? Is there another supported public macOS API better suited to establishing authoritative current-session liveness for an ASID obtained from an audit token? The security requirement is fail-closed. I’m specifically trying to avoid private APIs, process-table heuristics, diagnostic launchctl output, or assumptions that the ASID encoded in a previously received audit token necessarily represents current session state. If the public API does not provide an authoritative liveness/freshness guarantee, confirmation of that limitation would also answer the design question. I also have a minimal 122-line Xcode sample that: creates and receives a Mach message, reads the kernel-provided audit trailer, extracts the ASID, calls SessionGetInfo, and prints the returned session ID and attributes. I can provide the sample project if useful.

Hi! We have an app that highly depends on CoreBluetooth including scanning for peripherals with an advertised serviceUUID. Our app sets the CBCentralManagerScanOptionAllowDuplicatesKey flag to true while scanning. Receiving continuous discovery events about nearby devices is key to measure the RSSI before connecting. Updating some of our test devices to watchOS 27 we noticed that our app is broken. To analyze further we created a simple app to compare behavior between watchOS 26 and 27, and the difference is clear. On the 27 device it behaves like the flag is ignored and we only receive a couple of callbacks to centralManager(_:didDiscover:advertisementData:rssi:) then it stops. We could not find any documentation declaring this as a new restriction or something regarding that has changed. Is this a bug, or is there a way to get the old behavior on the new OS? The example app used for testing is available here: https://github.com/levente-gulyas-skidata/WatchBLEExperiments (Change the serviceUUID for testing if needed) Thank you, Levi

I am developing a diagnostic tool for an external NVMe storage device connected to a Mac through USB4 PCIe tunnelling. The device appears under IONVMeController and IONVMeBlockStorageDevice, not as USB mass storage. Basic communication works through IONVMeSMARTInterface, but I have not found a supported way to request a fresh host-initiated telemetry snapshot or retrieve its data using log-page offsets. Environment macOS 26.5.1, build 25F80 Apple Silicon, arm64 NVMe SMART interface version 1, revision 0 Controller Identify reports Log Page Attributes 0x0f, including telemetry support What Works I open the interface using IOCreatePlugInInterfaceForService and QueryInterface with the UUIDs declared in the SDK’s NVMeSMARTLibExternal.h. The following operations succeed: GetIdentifyData SMARTReadData GetLogPage for the SMART/health log, LID 0x02 Reading the host-initiated telemetry header, LID 0x07 My current prototype uses Python ctypes, with the layout and signatures matching the SDK header. Required Telemetry Operations For host-initiated telemetry, the application needs to: Issue Get Log Page for LID 0x07, with LSP bit 0 set to request snapshot creation: CDW10 bit 8. Read the 512-byte telemetry header to determine the available data size. Retrieve subsequent portions of the same snapshot using the log-page offset in CDW12/CDW13. I would also like to understand whether RAE, CDW10 bit 15, can be controlled. This workflow works on Windows and Linux against the same device. We have access to device-side command logging, so we can inspect the command fields received by the firmware. Available macOS API The SDK declares: IOReturn (*GetLogPage)( void *interface, void *data, uint32_t inLogPageId, uint32_t inNumDWords); The header describes inNumDWords as zero-based and references NVMe revision 1.0c. I do not see parameters for LSP, RAE, or the log-page offset. The published documentation is: https://developer.apple.com/documentation/iokit/ionvmesmartinterface/3521169-getlogpage Observed Behavior An ordinary 512-byte telemetry read produces the following device-side command: CDW10 = 0x007f0007 CDW11 = 0x00000000 CDW12 = 0x00000000 CDW13 = 0x00000000 LID = 0x07 LSP = 0 Create = false NUMD = 127 Offset = 0 The firmware returns a valid telemetry header advertising no payload because no snapshot has been created. For comparison, the working Windows request reaches the device as: CDW10 = 0x007f0107 Create = true The firmware then creates an approximately 32 KiB diagnostic archive. Subsequent Windows requests retrieve it in chunks using nonzero CDW12 offsets. As an explicitly unsupported experiment, I passed inLogPageId = 0x0107 to test whether the additional bit could reach CDW10. The call succeeded, but the device still received CDW10 = 0x007f0007; Create was not set. Inspection of the installed NVMeSMARTLib plugin shows that its wrapper forwards the two 32-bit arguments unchanged toIOConnectCallStructMethod, selector 5. This does not establish how the kernel driver interprets them, and I am not relying on that experimental encoding as a supported API. Questions Is there a supported userspace interface for NVMe Get Log Page that exposes LSP/Create, RAE, and the 64-bit log-page offset? Does IONVMeSMARTInterface.GetLogPage support these fields through any documented mechanism that I have missed? If not, is there another supported NVMe admin-command interface available to third-party applications for external PCIe-tunnelled controllers? What transfer-size limits and privilege or entitlement requirements apply to the recommended interface? If this functionality is not currently exposed, is Feedback Assistant the appropriate place to request it, and which component should the report target? I am looking for a supported solution that works with normal macOS security settings, without disabling SIP or replacing the active storage driver. The goal is diagnostic telemetry retrieval, not firmware updating or namespace writes.

macOS guest (Virtualization.framework) freezes with all vCPUs halted right after a macOS update reboot - 3/3 on a macOS 26.7.1 (25G309) M4 host, seen with both UTM and Parallels Summary On a macOS 26.7.1 (25G309, beta/seed build) host with an Apple M4, every macOS guest that runs an in-place macOS update freezes at the same point: the in-OS phase of the update completes and reports success, the guest requests a reboot, records a shutdown stall 9 seconds later, reboots twice, shows the update progress screen for about a minute, and then stops. All four vCPUs enter WFI and never wake, paravirtualized graphics stops submitting, no I/O is pending on the host side, and no host service logs an error. The VM never recovers and has to be killed. Reproduced 3 out of 3 times, under two different front-ends (UTM and Parallels Desktop) and two guest versions (15.7.x and 26.6.2). Environment Host: iMac (Mac16,3), Apple M4, 16 GB RAM, macOS 26.7.1 build 25G309 (seed channel), installed the evening before the first failure. Primary guest: macOS 15.7.9 (24G830), hardware model VirtualMac2,1, 4 vCPUs, 6 GB RAM, 90 GB raw disk image (virtio-blk) stored on an external USB SSD. Networking bridged to the built-in Ethernet port. Devices enabled: memory balloon, audio, entropy, clipboard sharing; display 1920x1200 with dynamic resolution. Front-end for the primary case: UTM [version], Apple Virtualization backend. Guest was the only VM running, cold-booted, window open. Update being applied: MSU_UPDATE_24H23_patch_15.8_minor (15.7.9 -> 15.8). Other cases: a macOS 26.6.2 guest under UTM; a macOS 15.7.7 -> 15.8 guest under Parallels Desktop 26.4.2 (57518). Steps to reproduce Cold-boot a macOS 15.7.9 guest under Virtualization.framework, as the only VM on the host. In the guest: System Settings > Software Update > install macOS 15.8. Let it reboot. Expected The guest installs the update and boots into 15.8. Actual — timeline of the primary case (R = the moment Software Update requested the reboot; absolute timestamps are in the attached logs) R-23 min to R-5 min: UpdateBrainService prepares the update inside the guest, writing about 25 GB (two "disk writes" resource reports: 16.5 GB then 8.5 GB). No errors. R-1:56: post-logout install configured; disk space check passes (5.7 GB required, 40.7 GB free). R-1:44: "SUOSUPostLogoutInstallOperation: Applying MSU update". R: "Applied MSU update"; FileVault stash committed ("kAppleFDEKeyStore_commitStash success"); "Rebooting (success = 1, displayAsleep = 0, shutdown = 0)". This is the last line the guest ever writes to install.log. R+9 s: the guest writes a shutdown_stall diagnostic report. R+10 s: host sees ParavirtualizedGraphics "Device reset" / "PGDisplayNub[0]: Destroyed" (reboot #1). R+1:20: second device reset (reboot #2), 70 s after the first. On the host, the vmnet interface is torn down and recreated with no error, the AppleVirtualPlatformIdentity service completes boot attestation with no error, and the guest's graphics driver renegotiates ("Guest requested binary version: 209"). R+1:38: host logs "PGDisplay[0]: Change display mode to 3606x2254" — the guest is on the update progress screen. R+1:41 to R+2:25: the guest's six PGFifoThreads go idle one at a time. The progress bar stops partway. No further activity of any kind. R+11:35: spindump of the VM host process (com.apple.Virtualization.VirtualMachine): 0.042 s of CPU over a 5 s sample all four com.apple.virtualization.thread.cpu-N threads in Hv::Vcpu::run() -> HvCore::Hypervisor::VcpuStateManager::wait_for_interrupt() -> __psynch_cvwait cpu-0/cpu-1 wake on a ~20 ms timer tick and return to WFI; cpu-2/cpu-3 had not run for seconds no thread in any file read, write or fsync (no host I/O outstanding) PGFifoThreads last ran 550–614 s earlier process state Ss (sleeping), not U Host kernel log for the window: no USB, APFS, I/O error, timeout or reset entries. No hardware video decoder (AppleAVD) errors. The VM was left for over an hour with no change, then killed. Second case (same host, same day, UTM, guest macOS 26.6.2) Identical signature: two graphics device resets 69 s apart, display mode set 3 s after the second one, last graphics activity about a second later, then all vCPUs idle in WFI for ~6.5 hours until the VM was killed. Third case (same host, same day, Parallels Desktop 26.4.2, guest 15.7.7 -> 15.8) The guest was suspended in the middle of its update and resumed later. On resume ("-[_PGDevice willResumeWithSuspendState:error:]: Begin resume", preceded by "[VirtualMachineParameterBuilder] Failed to get auxiliary file identifier"), paravirtualized graphics never came back — its FIFO threads ran once and never again — and the guest's vCPUs sat in WFI. This may be a separate save/restore defect, but the end state is the same. What I believe is ruled out The in-OS phase of the update: it completed and reported success. Guest kernel panic: vCPUs are halted, not spinning, and there is no panic report on the guest's data volume. Disk space: 40.7 GB free in the guest at install time. Host storage stall: no uninterruptible wait, no I/O frames in the spindump, no kernel storage errors. Host hardware video decoder: no AppleAVD errors in the primary case. Host services: vmnet and AppleVirtualPlatformIdentity completed normally seconds before the hang. Guest memory: 6 GB allocated. Not yet isolated The VM images live on an external USB SSD; not yet reproduced from internal storage. The memory balloon, audio and clipboard-sharing devices were enabled; not yet reproduced with them disabled. A third-party VPN client was running on the host (guest networking is bridged, so guest traffic bypasses the host tunnel, but host firewall rules could still affect bridged frames). I don't have a confirmed-good in-place guest update on this machine from before 26.7.1, so I can't state with certainty that this is a regression. Frequency 3 of 3 attempts on this host. Attachments / available on request spindumps of the hung VM host process (primary case and second case) host unified-log excerpts for both hang windows the guest's full install.log the guest's shutdown_stall report and the two UpdateBrainService disk-writes reports sysdiagnose captured while hung, if obtained Has anyone seen macOS guests stop at this point on the 26.7.x seeds? If you can reproduce, your host build, hypervisor, and whether the VM image is on internal or external storage would be useful to compare.

Hi everyone & DTS engineers, I am developing a macOS application that uses Apple's Virtualization framework and vmnet APIs. In my main application bundle, I have requested and received approval for the restricted entitlement com.apple.vm.networking. The main app works as expected with bridging/vmnet features. Now, I have embedded a command-line helper binary inside the app bundle (Contents/MacOS/). The helper is configured as follows: Set up with com.apple.security.app-sandbox = true Inherits App Sandbox rules (com.apple.security.inherit = true) Signed with com.apple.vm.networking = true in its entitlements file. However, when launching or invoking networking features from this helper binary, it fails to execute the expected vmnet functions / gets blocked at runtime. My questions for DTS / Apple Engineers: Since com.apple.vm.networking is a restricted entitlement tied to a specific App ID / Provisioning Profile, does an embedded CLI helper tool with its own Bundle ID need to be explicitly registered and granted this entitlement separately in the Developer Portal? If the helper uses com.apple.security.inherit, does AMFI still strictly evaluate the helper's own provisioning profile signature against com.apple.vm.networking independently of the main app bundle? What is the recommended architectural pattern for vmnet access when using helper tools—should network creation stay strictly in the main app process and communicate via XPC, or should the helper tool be granted its own matching profile and entitlement? Thanks in advance for any insight!

Hello, I am developing a native macOS utility using SwiftUI and AppKit, and I am investigating whether its power scheduling features can be implemented in a sandboxed app distributed through the Mac App Store. The intended functionality is: Schedule power-on from a fully shut-down state, not just wake from sleep. Schedule wake from sleep and shutdown. Let the user select weekdays and times, and modify or cancel the schedule. Keep the schedule effective after the user quits the app. For example, the user could explicitly configure power-on at 08:00 and shutdown at 22:00, Monday through Friday. My local prototype uses pmset with administrator authorization. For a possible Mac App Store version, I am looking for a supported implementation that does not execute privileged shell commands or run an application helper as root. What I have checked The documentation for IOPMSchedulePowerEvent states that it must be called as root. Calling that API directly therefore does not appear to remove the privilege requirement. App Review Guideline 2.4.5 requires sandboxing and prohibits requesting escalation to root privileges. I also reviewed launchd scheduling and user-supplied scripts through NSUserAppleScriptTask, but neither appears to provide a self-contained solution for scheduling power-on from shutdown without privileged operations. Questions Is there a public API or system-mediated authorization mechanism that supports this functionality from a sandboxed third-party app? Is there a requestable entitlement specifically applicable to power-event scheduling? If the complete feature set is unsupported, which operations are available within App Sandbox: power-on from shutdown, wake from sleep, and scheduled shutdown? The current deployment target is macOS 13 or later, on Apple silicon and Intel. If a supported solution requires a newer macOS version or specific hardware, that information would also be helpful. I am asking about supported API capabilities and architecture, rather than advance App Review approval. A documentation reference—or confirmation that scheduled power-on from shutdown is unavailable under these constraints—would help me choose the appropriate distribution model. Thank you.

Virtualization.framework: guest teardown after VM-owner failure We are evaluating an ARM64 Linux guest using Virtualization.framework on macOS 26.6. If the process owning VZVirtualMachine is suspended, hangs on its VM queue, or is forcibly terminated: Does Apple provide a supported guarantee that termination of the owning process also terminates all guest execution resources? Which documentation defines this behaviour? Can a separate surviving process identify and forcibly stop that specific VM through a public API? What supported positive observation can that surviving process obtain to confirm guest execution has ended after the owner is gone? Are any teardown deadlines guaranteed, or must they be measured? We need to distinguish confirmed teardown from owner-process exit, lost telemetry or disconnected IPC. We are seeking documented lifecycle behaviour and supported APIs, without relying on private framework internals.

Hi Quinn — following up from DTS case 22070584. I'm working on a Windows compatibility runtime (Wine plus a CPU translator) that runs natively on Apple Silicon. 64-bit x86 Windows programs work fine. 32-bit ones don't, because they need address space in the low 4 GB: guest pointers are 32-bit, and some Windows structures sit at fixed addresses like 0x7ffe0000 that programs read directly. On arm64 I can't get anything down there: task_info(TASK_VM_INFO) -> min_address 0x100ea0000 mmap(0x7ffe0000, MAP_FIXED) -> ENOMEM mach_vm_allocate(0x7ffe0000, VM_FLAGS_FIXED) -> KERN_INVALID_ADDRESS There's also nothing below 4 GB to remove: mach_vm_region finds no entry there at all, and mach_vm_deallocate(0, 4 GB) returns KERN_SUCCESS without changing anything. Building with a smaller __PAGEZERO doesn't help either — every size I tried (0x1000, 0x4000, 0x10000, 0x100000, 0x1000000, 0x10000000, 0x80000000) gets SIGKILLed before main, with no crash report. Ad-hoc signing, the hardened runtime and -no_pie made no difference. I did notice /usr/libexec/rosetta/runtime is arm64 with no __PAGEZERO segment at all and __TEXT at vmaddr 0, so the kernel can clearly do this, at least for platform binaries. Is there a supported way for a third-party arm64 process to map below 4 GB — an entitlement, a spawn attribute, something I've missed? If the answer is no, that's fine, I'd just like to know so I can stop looking and plan around it. I have two small test programs that print all of the above if they'd be useful.

Summary We use Virtualization.framework to run macOS guests on Apple silicon. When the guest is updated from macOS 15.6.1 to 15.8.1 inside the VM, the update writes a new boot loader, mBoot-20457.1.29, into the VM's auxiliary storage. After the update, the guest kernel can use only about 1.75 GB of the configured memory. The kernel wires the rest as VM_KERN_COUNT_BOOT_STOLEN. The guest swaps all the time, and builds become 7 to 18 times slower. The fault stays after a cold boot. The guest boot-args value is empty. Environment Host: macOS 26.7.2 (25G320), Apple M3 Pro, 36 GB Guest before the update: macOS 15.6.1 (24G90), installed from the IPSW Guest after the update: macOS 15.8.1 (24H32), installed with softwareupdate inside the guest VM configuration: VZMacOSBootLoader with the default ROM, VZMacPlatformConfiguration, VZMacAuxiliaryStorage, memorySize = 15032385536 (14 GiB), CPUCount = 6 A customer sees the same fault on macOS 26.6.2 with an M2 Pro host. Steps to reproduce Create a macOS 15.6.1 VM from the IPSW. Set memory to 14 GiB. Boot the guest and confirm the RAM. vm_stat accounts for about 14 GiB. In the guest, run: sudo softwareupdate --install "macOS Sequoia 15.8.1-24H32" --restart --agree-to-license --user <owner> --stdinpass After the guest restarts, run sudo zprint | grep BOOT_STOLEN and vm_stat. Shut down the VM, start it again, and do step 4 again. Expected result The guest can use about 14 GiB of RAM, as it could before the update. Actual result 15.6.1, before the update 15.8.1, after the update and after a cold boot hw.memsize 15032385536 15032385536 RAM accounted for by vm_stat (free + active + inactive + speculative + wired + compressor) about 13.99 GiB about 1.75 GiB VM_KERN_COUNT_BOOT_STOLEN not measured 12,845,072 KB (about 12.25 GiB) Swap activity Swapins 0, Swapouts 0 Swapins 225,835, Swapouts 267,316 nvram boot-args empty empty Auxiliary storage contents after the update The auxiliary storage has two boot loader slots. Each slot has a 16-byte HUFA header: magic, version, upgrade count, and slot offset from 0x4000. Header offset Upgrade count Slot offset Boot loader 0x4000 1 0x24000 iBoot-11881.140.96 (the original 15.6.1 boot loader) 0x5000 2 0x224000 mBoot-20457.1.29 (written by the 15.8.1 update) The VM boots the slot with the higher count, which is mBoot-20457.1.29. Workaround test (customer) The customer worked on a copy of an affected VM. They copied the iBoot-11881.140.96 slot over the active mBoot-20457.1.29 slot in the auxiliary storage. macOS 15.8.1 then booted with about 14 GB of usable RAM, and the RAM stayed correct after cold boots. Their results: Extraction and validation of nine Xcode versions: 9 to 10 minutes (it was 68 to 102 minutes). Xcode 26.1.1 simulator installation and cache preparation: under 7 minutes (it was more than 2 hours). This workaround changes Apple's signed firmware by hand... Not really a good idea. Related report A public report describes the same fault with UTM and the same boot loader version. It also says that the kernel computes the stolen value from the memSizeActual and memSize boot parameters that the boot loader supplies. The author filed FB24992831 (https://wadetregaskis.com/the-macos-sequoia-15-8-updater-stole-my-ram/) Questions Is this a known fault in mBoot-20457.1.29? Will a later update fix it? Is there a supported way to make a VM boot a specific boot loader slot? Or a supported way to roll back the boot loader in VZMacAuxiliaryStorage? Is there a configuration on the host or in the guest that makes mBoot pass the full memory size? We'd prefer to not make nvram read only if the new mBoot is absolutely needed for some reason.

We are qualifying a local macOS control service on Apple Silicon, macOS 26.5.2 (25F84). Browser control sessions must be revoked on graphical screen lock; unlock must not restore old sessions. Background project execution and durable pending decisions continue independently. We built a correctly signed user-context helper using its own data protection Keychain access group and a nonsecret WhenUnlockedThisDeviceOnly item. Every call uses a fresh noninteractive LAContext and requests actual item data. In one user-confirmed stock screen lock/unlock test, reads returned errSecInteractionNotAllowed while locked and expected data after unlock. This is one observation, not a general screen-state contract. The installed EndpointSecurity SDK explicitly states that es_graphical_session_id_t is not an audit session ID. CoreGraphics public caller-session properties expose UID, on-console and login-done, but no documented lock-state/current ES graphical-session identifier. What supported API maps a caller Aqua user-context process or NSXPCConnection audit session to the relevant ES graphical_session_id? If none exists, what supported binding should a trusted user-context helper use for current graphical lock authority, including Fast User Switching and Screen Sharing contexts? Does a fresh successful macOS DP WhenUnlockedThisDeviceOnly data read imply that this graphical session is unlocked? How does the documented SSH path that unlocks the login Keychain and DP Keychain interact with a still-locked graphical session or another context of the same UID? Is there a supported coherent current-lock snapshot/subscription mechanism for initial startup or observer restart? What completeness, ordering and maximum latency contracts apply to userspace-produced ES LoginWindow lock events? Does any supported fence detect a final delayed/lost lock or a lock+unlock between two protected reads? Does any supported API bind the unlocked condition to a subsequent application control decision, such as an application-owned SQLite COMMIT? A receiver-side monotonic freshness check can reject late replies during coordinator stalls, but its final check and COMMIT remain separate operations. We seek a supported contract or OS-enforced mechanism for this boundary. We can conservatively revoke all broker control sessions on any trusted graphical lock instead of guessing an ASID→graphical-ID mapping, but this still leaves bootstrap/current-state and event completeness open. We have not assumed private CGSession keys, audit authentication flags, a helper heartbeat, or a queue-tail fence prove screen-unlocked state. Primary references: TN3137, SecItem: Pitfalls and Best Practices, ES graphical session ID, CG session dictionary, XPC audit session.

Hello, I am working on a DLP solution for macOS using the Endpoint Security framework. I have faced unexpected behavior regarding process identities. Upon receiving an ES_EVENT_TYPE_NOTIFY_EXEC event, my aplication caches the process details for future use by other internal components. This structure stores user identity tokens, including auid, euid, and ruid. However, I noticed that in subsequent ES_EVENT_TYPE_NOTIFY_CLOSE events for the exact same PID, the audit token arrives with a different audit uid, even though no ES_EVENT_TYPE_NOTIFY_EXIT event was triggered for this process. Could you please help me clarify the following questions: In my case the initial value of audit uid is equal to AU_DEFAUDITID. What does it mean? (ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_CLOSE are triggered by a file copy operation in Finder) How is audit uid changing possible? Is there any way to catch it via Endpoint Security? Thank you in advance!

I am designing a macOS Virtualization application using RAW disk images, an EFI variable store and host directory sharing. I need to distinguish stopping guest execution from releasing host backing-file access. I inspected the public declarations for VZDiskImageStorageDeviceAttachment, VZEFIVariableStore, VZSharedDirectory and VZVirtualMachine in the macOS27 SDK. The stop completion describes a stopped VM or an error; the backing types expose URL-based initialization. I could not identify a final backing-release event in those declarations. I would appreciate the supported contract, including any differences on macOS26 and macOS27. For each of the three URL-backed surfaces: When are paths resolved and backing references opened? Can the framework reopen a path or lazily access shared descendants later? Does successful stop completion guarantee backing references are released and required writes persisted, or only that guest execution stopped? What object-reference release and queue/callback ordering is required before the application may safely reuse, replace or remove the backing objects? Can Virtualization helper processes retain backing access after the application's worker process exits? Is there a supported observable event covering those references? If no such release event is documented, what supported architecture should retain or quarantine these resources until release can be established? I am not using physical block devices and am not generalizing their documented file-handle retention to URL-backed images, EFI stores or directory shares. Please link the public contract or clarify which behaviors are unspecified.

Hello, I'm evaluating a local macOS helper service with a minimum deployment target of macOS 13. The service would communicate over an AF_UNIX SOCK_STREAM socket and must authenticate the signed code identity of the connecting process before accepting an operation. I'm investigating whether LOCAL_PEERTOKEN can provide a reliable audit token associated with the peer of an accepted socket. The public macOS SDK declares LOCAL_PEERTOKEN in sys/un.h, but I haven't found documentation establishing its precise security guarantees or availability across supported macOS versions. My questions are: Is LOCAL_PEERTOKEN a public, supported API on macOS 13 and later? Can it be used with getsockopt() on a file descriptor returned by accept() to retrieve an audit_token_t for the connected peer? At what point is the peer identity captured? Is the returned audit token securely bound to the original connecting process, even if that process exits and its PID is reused? Is the audit token obtained through LOCAL_PEERTOKEN officially supported as input to Security.framework APIs such as SecCodeCopyGuestWithAttributes (using kSecGuestAttributeAudit) or SecTaskCreateWithAuditToken? Does the identity remain trustworthy if the connected socket descriptor is inherited or passed to another process? Are there documented limitations concerning descriptor passing or time-of-check/time-of-use races? What is Apple's recommended public API sequence for verifying the signed code identity of an AF_UNIX peer on macOS 13+, including in an App Sandbox environment? I'm looking for documented security and availability guarantees rather than relying solely on observed behavior. Thank you!

There have been 2 serious regressions in the hypervisor framework since developer beta 6 of macOS 27 that have continued into the final release, and the first beta of 27.2 The first is that since developer beta 6 of macOS 27, virtual machines that have an Apple ID with iCloud+ signed in fail to route traffic in Safari through iCloud Private Relay despite it being on. Parallels, UTM, VirtualBuddy have all been tested and the issue applies to all of them, exposing the host machine's IP address. I have reported the issue since I discovered it and there hasn't been any communication that Apple even knows its an issue to my open report in Feedback Assistant. The second issue is a newer one, and it affects macOS 26.6.2 and earlier virtual machines. Attempting to install 26.7 through the built-in software update causes the virtual machine to black screen upon reboot during the installation. Forcing the machine off and back on causes the virtual machine to revert back to macOS 26.6.2. There has been no available IPSW file to test if a clean install of 26.7 in a virtual machine is a viable workaround, or to see if there is a bug in the updating mechanism or bug in the 26.7 release itself in virtual machines. The Parallels Desktop forum is beginning to get reports from users of that software of the same black screen issue trying to update their own 26.6.2 VMs to 26.7. These issues have also not been corrected in either 27.2 Beta 1 nor 26.7.1 Has anyone found a workaround to either of these 2 issues, or submitted similar reports and got any kind of response from Apple? The feedback reports about these issues are FB24828992 and FB24791716

I am implementing a sandboxed macOS sync app using NSFileProviderReplicatedExtension, with a minimum deployment target of macOS 13. The requirement is for a user to select an arbitrary existing, nonempty APFS directory, for example /Users/example/Documents/SyncExample, and turn its synchronized files into real on-demand items while preserving that directory's original physical path and file-system identity. Moving it into CloudStorage, substituting a symlink or alias, or changing only Finder presentation would not satisfy the requirement. After the exact file version has been uploaded and verified, the app needs to support safe native eviction and later materialization in that same directory. The documentation for NSFileProviderManager.import(_:fromDirectoryAt:completionHandler:) describes migration into the system's managed cache, after which the original URL is no longer valid: https://developer.apple.com/documentation/fileprovider/nsfileprovidermanager/import(_:fromdirectoryat:completionhandler:) The documented Desktop/Documents and external-volume features do not appear to select an arbitrary subdirectory: https://developer.apple.com/documentation/Updates/FileProvider Is there a supported public API that meets this requirement on macOS 13? If not, does a newer macOS version support this for arbitrary existing subdirectories, rather than only known folders or volume placement? Please point me to the appropriate API and its precise constraints, or clarify the platform limitation. No private APIs, manual dataless flags, or fake placeholders would be used. The directory above is fictional.

We are developing a security-sensitive local execution system on macOS and need clarification about supported Darwin/APFS filesystem APIs. Our requirement is to create an additional directory entry (hard link) for an existing, authorized regular-file object while retaining its original directory entry. SECURITY REQUIREMENTS The source file has already been opened and its identity verified using a held file descriptor and fstat(). The source must remain the exact same filesystem object (device/inode identity), not a copy or clone. An attacker operating under the same user account may concurrently rename, unlink, or replace the source pathname. The publication operation must not create a hard link to, or otherwise mutate, a substituted source object. The new link must be created within an already-open, authorized destination directory. Unsupported configurations must be detectable before attempting a potentially unsafe publication mutation. The original source directory entry must remain present. We have reviewed linkat(), fclonefileat(), rename-based approaches, filesystem flags, and directory-descriptor-relative operations. The difficulty is that linkat() identifies its source through a pathname. Holding a verified source file descriptor does not appear to guarantee that the pathname still identifies the same object when linkat() performs the mutation. A subsequent fstat() or pathname identity check cannot undo an already-created link to a substituted object. QUESTIONS Does macOS provide a supported public API that creates an additional hard link directly from an existing open file descriptor, without resolving a replaceable source pathname? Does Darwin support an equivalent of Linux linkat() with AT_EMPTY_PATH, or another documented descriptor-based source-linking mechanism? Can any supported macOS filesystem API guarantee that a concurrent same-user replacement of the source directory entry cannot redirect the publication mutation? If descriptor-based hard linking is unavailable, is there a supported filesystem or namespace protection mechanism that prevents same-owner source-entry substitution throughout the operation? Do AT_SYMLINK_FOLLOW, AT_SYMLINK_NOFOLLOW, AT_RESOLVE_BENEATH, AT_RESOLVE_NOFOLLOW_ANY, or related Darwin flags provide any guarantee that the linked source is the previously verified inode rather than a replacement? Are the relevant guarantees dependent on macOS version, APFS volume configuration, filesystem flags, privileges, or entitlements? Is there a supported way to determine whether the required operation and guarantees are available before performing the publication mutation? We are specifically interested in documented and supported APIs, their identity guarantees, availability conditions, and limitations. We are not seeking a workaround based solely on comparing file identities after the operation, copying/cloning the file, or assuming that same-user pathname replacement cannot occur. If no supported public API provides these guarantees, confirmation of that limitation would also be helpful. Thank you.

We're seeing a recurring kernel panic across six Mac17-family Macs (Mac17,2 / Mac17,4 / Mac17,8; T8142 and T6050) in a managed fleet. 34 panic logs collected 30 Sept – 9 Oct, all with the same signature: panic(cpu N caller ...): Kernel tag check fault (expected tagged address: 0x...028), esr 0x96000011 Faulting address is always at offset 0x28 of the object Same crash PC per build: kernel text exec base + 0x48da38 on 27.0/27.0.1, + 0x46a784 on 26.7, + 0x466ee0 on 26.5 Panicked task is "Google Chrome Helper" in all 34 cases, thread Chrome_ChildIOThread (Chrome's IPC/network I/O thread) Always 3–60 s after wake from sleep, usually a dark wake with the lid closed (overnight or after a 3–18 min sleep) No third-party kexts loaded; "Post-boot loaded kexts" lists only Apple drivers Affected builds: 26.5 (25F71), 26.7 (25G229), 27.0 (26A428), 27.0.1 (26A434). Not a regression from one update: a machine still on 26.5 panics identically. Only Mac17-family hardware is affected. Older Apple silicon Macs with the same software stack are fine. Present on every affected machine: Chrome PWAs (Gmail/Chat/Meet) running in the background, keeping Chrome's network service alive across sleep. On one machine Microsoft Edge is the primary browser and never panics; only Chrome Helper does. Microsoft Defender for Endpoint with its network filter (content filter) extension, MDM-managed. This looks related to thread 821372, where DTS described a kernel networking panic on M5-family hardware with a Network Extension present (r.172793638 / FB22401652), fixed in 26.5b2. We appear to be seeing a tag-check-fault variant on 26.5 release and later. Questions: Is this a known issue, and is it the same root cause as r.172793638? Is there a build where it's fixed? Any recommended mitigation beyond preventing sleep and quitting Chrome? Feedback Assistant: FB25128015 with panic logs and sysdiagnose. Happy to collect more data or test a build. Backtrace from a 27.0.1 panic (kernel text exec base 0xfffffe003aa54000), panic PC first: lr: 0xfffffe003aee1a38 lr: 0xfffffe003aeec580 lr: 0xfffffe003b12cf34 lr: 0xfffffe003b12dc50 lr: 0xfffffe003b07b1f8 lr: 0xfffffe003b07c758 lr: 0xfffffe003b237ff4 lr: 0xfffffe003ac787f0 lr: 0xfffffe003aa576ac lr: 0x000000018747a57c (userspace)