Background: I am using Security.framework to verify the code signing requirements for incoming XPC connections (from listener: shouldAcceptNewConnection: in NSXPCListenerDelegate), as mentioned here:
https://developer.apple.com/forums/thread/72881
Problem: It is working well (for our normal processes), but not for when the XPC connection is coming from our Audio Server Plug-in. In this case, the main problem is that the SecCodeRef I'm getting is from the coreaudiod process, which is hosting the Audio Server Plug-In. I don't want coreaudiod's code-signing information; I want my plugin's code-signing information.
The current way I am getting the SecCodeRef is using the newConnection.processIdentifier, or the NSXPCConnection's audit token (if exposing the private API), but alas, those are for the hosting process and not my plugin.
Question: How do you get a dynamic SecCodeRef for a plugin and not the hosting process?
Possible Attempts: I have tried looking at the header file for SecCodeCopyGuestWithAttributes() and how the first argument, host, used as a starting point, as if you can nest and drill down, but I haven't gotten that to work.
I could probably get a SecStaticCodeRef ,for the binary on disk, but that is not the dynamic running code.
