Endpoint Security Extensions using low level (C-based) xpc API

Question

Created Apr ’21

Replies 2

Boosts 0

Participants 2

Hello,

I have develop a Endpoint Security Extension based on the video that I see from the WWDC20. The extensions is embedded in an app that it only use to install the extension. This is working pretty well. I can see that the extension is running when I use

Code Block systemextensionsctl list

.

I run this extension in a VM with SIP disabled.

The next step is to set up an XPC connection using the low level (C-based) API to communicate data from the extension with an external line commande tools.

I tried to use the

Code Block NSEndpointSecurityMachServiceName <bundleID>.test.xpc

in the Extension's info.plist so the extension should be able to create a xpc connection by using

Code Block xpc_connection_create_mach_service(<bundleID>.test.xpc, NULL, XPC_CONNECTION_MACH_SERVICE_LISTENER)

.

It seems not to be working well because when I tried to connect to this listener from a command line tools project using

Code Block xpc_connection_create_mach_service(<bundleID>.test.xpc, NULL, XPC_CONNECTION_MACH_SERVICE_PRIVILEGED)

I only got a

Code Block Connection Invalid

Is it even possible to use a xpc connection in an Endpoint Security Extension to communicate with an external process? If yes, can you explain me how to do it properly because I don't find any documentation about it.

Thank you,

Boost

Answer 1

mdolan OP

Apr ’21

I believe you are running into this problem, you need to define

Code Block 	<key>NSEndpointSecurityMachServiceName</key>
	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>

in your info.plist. It's been a while since I fought this, but I think that right now it's publishing your XPC endpoint as <TeamID>.<bundle ID>.text.xpc

I'm sure that Quinn or others will correct me if I'm wrong.

0

Answer 2

Jozzz OP

Apr ’21

Hello,

Thanks a lot for your answer, it's working well now.

I wondering if it is a safe method to do it because I read about anonymous connection in the documentation that can avoid man-in-the-middle attack on named connection.

Can you tell me if their is a possible man-in-the-middle attack on the connection that I describe before?

Thank you

0