NSConnection between Endpoint security system extension and an application

Hello,
I don't manage to establish a connection between my Endpoint security system extension and my application.
The following command always returns nil:
NSConnection *conn = [NSConnection connectionWithRegisteredName:serverName host:nil];

It works from a FinderSync extension, so I'm sure that the server part (my application) is working.
I have "NSLogged" the "serverName", so I'm sure that it's correct.

Here is the entitlements of the app:
% codesign -d --entitlements :- /Applications/myApp.app                             
Executable=/Applications/myApp.app/Contents/MacOS/myApp
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http...PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.application-groups</key>
<array>
<string>123ABCDEFG.a.b.c.d</string>
</array>
</dict>
</plist>

The entitlements of my Extension:
% codesign -d --entitlements :- /Users/myuser/Library/Developer/Xcode/DerivedData/myApp-hjadpvvlcxmludafetdemwmwwglv/Build/Products/Debug/a.b.c.d.myAppLS.Extension.systemextension
Executable=/Users/myuser/Library/Developer/Xcode/DerivedData/myApp-hjadpvvlcxmludafetdemwmwwglv/Build/Products/Debug/a.b.c.d.myAppLS.Extension.systemextension/Contents/MacOS/a.b.c.d.myAppLS.Extension
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http...PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.application-identifier</key>
<string>123ABCDEFG.a.b.c.d.myAppLS.Extension</string>
<key>com.apple.developer.endpoint-security.client</key>
<true/>
<key>com.apple.developer.team-identifier</key>
<string>123ABCDEFG</string>
<key>com.apple.security.application-groups</key>
<array>
<string>123ABCDEFG.a.b.c.d</string>
</array>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>

So, both belong to the same app group.

I'm able to start the extension successfully:
% systemextensionsctl list
1 extension(s)
  • -- com.apple.system_extension.endpoint_security

enabled active teamID bundleID (version) name [state]
  • * 123ABCDEFG a.b.c.d.myAppLS.Extension (1.0/1) myApp LS Extension [activated enabled]

But the connection to the app is not working.
What should I check?
Thank you.
Answered by chrilarc in 668353022


If you add an XPC Service to an app then the service is registered in the app’s namespace. Only that app can access it.



So, what should I do to communicate between my app and my sys ext?
Code Block
NSConnection *conn = [NSConnection connectionWithRegisteredName:serverName host:nil];


Yikes! You’re using Distributed Objects (DO). Don’t do that. It’s been deprecated for a while now and for good reason. It’s deeply broken.

It works from a FinderSync extension, so I'm sure that the server part
(my application) is working.

It sounds like you’re running your server in the app and your client in the ES sysex. Regardless of the DO issue above, that won’t work because of Mach boostrap namespace issues. Your sysex is running in the global Mach bootstrap namespace, so it can’t see a service registered by your app in the namespace associated with your GUI login session. Technote 2083 Daemons and Agents does into this issue in great detail.

When you take a step back this doesn’t make logical sense. If multiple users are running your app in different GUI login sessions, which one would your sysex connect to?

The standard way to set up comms between an app and an ES sysex is via NSEndpointSecurityMachServiceName. See EndpointSecurity man page.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Thank you for your answer.

Yikes! You’re using Distributed Objects (DO). Don’t do that. It’s been deprecated for a while now and for good reason. It’s deeply broken.

It's an old app and I didn't want to rewrite everything (now). The migration is not trivial...

The standard way to set up comms between an app and an ES sysex is via NSEndpointSecurityMachServiceName.

Ok, I will try to get by using this.
Hello!
So, I have added an XPC service to my application.
I'm able to communicate between the app and the service but still not between the system extension and the service.

The code is almost the same for the app and the system extension The only difference is:
_xpcConnection = [[NSXPCConnection alloc] initWithServiceName:_serviceName]; // App code
_xpcConnection = [[NSXPCConnection alloc] initWithMachServiceName:_serviceName options:0]; // Sys ext code

The interruptionHandler and invalidationHandler don't catch any error.
I don't see any error in the Console.
The service and sys ext belong to the same app group.
I have added NSEndpointSecurityMachServiceName to the Info.plist of the sys ext.
I have also tried to add it to the Info.plist of the service (not sure it's usefull or not).

"sudo launchctl procinfo ... " for the service:
endpoints = {
"a.b.c.d.e" = {
port = 0x105c77
active = 1
managed = 1
reset = 0
hide = 0
}
}

"sudo launchctl procinfo ... " for the sys ext:
endpoints = {
"a.b.c.d.e" = {
port = 0xf5d5b
active = 0
managed = 1
reset = 0
hide = 0
}
}

How can I debug that?
Thank you.

So, I have added an XPC service to my application.

If you add an XPC Service to an app then the service is registered in the app’s namespace. Only that app can access it.

I have added NSEndpointSecurityMachServiceName to the Info.plist of
the sys ext.

Right. The idea here is that the sysex provides an XPC service like a launchd daemon would, that is, using -[NSXPCListener initWithMachServiceName:]. This gets registered in the global namespace and is thus accessible to all processes (modulo App Sandbox restrictions).

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Accepted Answer


If you add an XPC Service to an app then the service is registered in the app’s namespace. Only that app can access it.



So, what should I do to communicate between my app and my sys ext?
Not solved, but I cannot remove the "Solved" badge I set by mistake...
Finally, I managed to make it work, I did not understand that the sys ext had to be the listener.
Thank you for your help.
It's really solved this time!
NSConnection between Endpoint security system extension and an application
 
 
Q