Hi All,
Starting from the SimpleFirewall Apple Network Extension example I managed to create an app with an Endpoint Security extension.
From the console I can see that the app is starting correctly and the System Extension is registered and loaded correctly by Sysextd:
attempting to realize extension with identifier com.***.***.endpointBut then the system extensions fails with:
System extension request failed: Invalid extension configuration in Info.plist and/or entitlementsThat is the same error I can see settings a breakpoint in:
func request(_ request: OSSystemExtensionRequest, didFailWithError error: Error)Note 1: My provisioning profile doesn't contain yet a com.apple.developer.endpoint-security.client (requested but not yet approved) but I removed it from the .entitlements file and added to the system extension info.plist, for development "should" be ok right?
Note 2: Keeping the entitlement in the .entitlements file but not having it in the Provisioning Profile obviously causes an error:
com.***.zuul: Unsatisfied entitlements: com.apple.developer.endpoint-security.clientWhat am I missing?
I noticed that the SimpleFirewall has a special configuration in the info.plist
<key>com.apple.developer.networking.networkextension</key>
<array>
<string>content-filter-provider</string>
</array>do I need to add something similar to the Endpoint Security?
First up, you should remove the App Sandbox entitlement (
com.apple.security.app-sandboxSecond, make sure you check the entitlements for your built binary, not your
.entitlementsFor example, here’s the entitlements I have in a test project I use for this sort of thing:
$ codesign -d --entitlements :- NullEndpointSecurity.app
…
<dict>
<key>com.apple.application-identifier</key>
<string>SKMME9E2Y8.com.example.apple-samplecode.NullEndpointSecurity</string>
<key>com.apple.developer.system-extension.install</key>
<true/>
<key>com.apple.developer.team-identifier</key>
<string>SKMME9E2Y8</string>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>
$
$ codesign -d --entitlements :- NullEndpointSecurity.app/Contents/Library/SystemExtensions/com.example.apple-samplecode.NullEndpointSecurity.Extension.systemextension
…
<dict>
<key>com.apple.application-identifier</key>
<string>SKMME9E2Y8.com.example.apple-samplecode.NullEndpointSecurity.Extension</string>
<key>com.apple.developer.endpoint-security.client</key>
<true/>
<key>com.apple.developer.team-identifier</key>
<string>SKMME9E2Y8</string>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>Third, disabling SIP should be sufficient for testing EndpointSecurity. Indeed, for a daemon that calls EndpointSecurity directly, disabling SIP is sufficient. However, if you’re building an EndpointSecurity system extension using Xcode, disabling SIP is not sufficient. We’re still investigating this (r. 57130762) but, in the meantime, you can get things working by first disabling SIP and then disabling AMFI:
$ sudo nvram boot-args="amfi_get_out_of_my_way=0x1”IMPORTANT Do not disable SIP on a machine you care about. I do all of my EndpointSecurity testing in a VM, so I don’t have to disable SIP on my main work machine. If testing in a VM is insufficient, test on dedicated ‘victim’ hardware, not on your main Mac.
Fourth, the above is only relevant for testing. When you go to deploy, you must be granted the EndpointSecurity entitlement (
com.apple.developer.endpoint-security.clientShare and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"