SysExt hangs while registered to ES_EVENT_TYPE_AUTH_MMAP

I have written a tiny system extension which handles
Code Block
ES_EVENT_TYPE_AUTH_MMAP
ES_EVENT_TYPE_AUTH_EXEC

I authorize both with the same code
Code Block
  es_auth_result_t auth_res = ES_AUTH_RESULT_ALLOW;
  es_respond_result_t respond;
  respond = es_respond_auth_result(client, message, auth_res, true);
  if (respond != ES_RESPOND_RESULT_SUCCESS)
    printf("error in respond\n");


but for some reason while I'm opening processes (i.e. Safari, Mail, etc..) they all hang.
I have tried removing either of the events, and figured while only receiving EXEC events, everything works as it should, but when only receiving MMAP events, every process hang and not responding.

is there a special handling for the MMAP event?

Accepted Reply

Okay I figured that it was my problem all the time, I had a return statement before without authorizing this event which causes the hang.
Thank you for your time!
I'll pay more attention next time :-)

Replies

is there a special handling for the mmap event?

Not that I’m aware of. Is this on 10.15.x? Or 11.0 beta?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
I'm running it on macOS 10.15.4

I'm running it on macOS 10.15.4

OK. You should definitely retest with both the latest 10.15.x and the latest 11.0 beta.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

OK. You should definitely retest with both the latest 10.15.x and the latest 11.0 beta.


Tested on macOS 10.15.6 and got the same results.
When using
Code Block
ES_EVENT_TYPE_NOTIFY_MMAP

everything seems to work good except I need to block this call instead of getting notified.
I'm wondering if I'm missing anything?!
I can post the entire code in my project if that's somehow helpful.
Okay I figured that it was my problem all the time, I had a return statement before without authorizing this event which causes the hang.
Thank you for your time!
I'll pay more attention next time :-)