Network Extension installation and multiple users

Question

kithrup OP

Created Oct ’22

Replies 4

Boosts 0

Participants 3

We have a network extension. It is bundled in an app, that is launched as a launch agent for each user.

When doing the install, the installer bootstraps the agent for each currently-logged-in console user.

When the agent runs, it checks to see if it is the current active console user, and if so, goes through the process of activating the extension. This part works fine.

But... if the installation is done while two users [haven't tried more than 2, sorry] are simultaneously logged in, SysPrefs gets launched for both users.

Is this expected behaviour?

Boost

Answer 1

DTS Engineer OP

Apple

Oct ’22

The System Extensions API is intended to be used by a GUI app in response to user actions (see this post). Folks who try to automate this inevitably run into problem. My recommendation is that:

For normal user scenarios, you use the System Extensions API as it was intended to be used.
If you need to support managed scenarios, you lean into the configuration profile sys and NE configuration options.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

kithrup OP

Oct ’22

It is a (faceless, but with menubar icon/menu) GUI app. It just happens to be automatically launched as an agent, both to ensure it's there for everyone, and to keep it running. It isn't automated, more than any other program is, and it's there to interact with (included activating and deactivating) the extension, as is required by Apple's design. And all that is done in a GUI context, which causes user interaction if necessary. (The only weird thing we're doing is, as part of the postinstall script, using launchctl bootstrap to get it running for all currently-logged in users. As is documented.)

And none of that answers my question, which was whether or not SysPrefs being launched on a resigned console was expected behaviour or not.

0

Answer 3

kithrup OP

Oct ’22

(Also, it reproduces when not run as a launch agent, so that's not the issue. It seems to be that the system will, when one user clicks "Open security prefs", open it on all sessions where the containing app is running. I'll try to make a small test case for a feedback, but that will take a fair amount of time when I don't particularly have a lot right now.)

0

Answer 4

kithrup OP

Oct ’22

I filed FB11653435, and attached a very simple project to it which demonstrates the issue.

0