site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding:x-system-of-record; bh=QoBbcY/y+L3GyL4hAMjbkG4oKy5o8AnHsptb4dgBQl4=; b=aU4Ji8NI7+6Vi2xyIM5j4/nedVu4j7Bt83qAHZl9Ftrt4wMWjdIRGeOKO2jjWovjEN ZV+1GPdM8VZwUVWhyq1w== Domainkey-signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=dkim-signature:mime-version:sender:in-reply-to:references:date: x-google-sender-auth:message-id:subject:from:to:cc:content-type: content-transfer-encoding:x-system-of-record; b=CHCoka4EqK46Y8Bi/WAewEOYQSCVmEN9Z00QiMCCahV5unIrigK1MXJyuVWoDBQkV 5SWh9x03sNPB+EdS1UbxA== Hi Ben, as far as I know, only apps signed with a certain Apple signature can call task_for_pid() on ports other than mach_task_self() without auth prompt, see http://lists.apple.com/archives/apple-cdsa/2008/Feb/msg00014.html If you only need to call task_for_pid() for processes you control, you can add code to these processes to let them send their mach_task_self() to your controlling program over mach IPC, and then call task_for_pid() on that from the controller. That's what we do for the task manager in chrome. Nico On Wed, Oct 12, 2011 at 9:33 AM, Ben Staveley-Taylor <ben.staveley-taylor@oracle.com> wrote:
I'm trying to use the task_for_pid() mach call. I've found several list posts and other items about the security requirements for this from 10.5 onwards and I believe I'm complying, but I just can't get it to work. Can anyone spot what I'm doing wrong?
Setup: ------
- Running on OS X 10.7.1 - I created a new Cocoa application with the code snippets shown below. - Info.plist contains: <key>SecTaskAccess</key> <array> <string>allowed</string> <string>safe</string> </array> - The app is codesigned using a self-signed certificate.
Behaviour: ----------
- If I sudo-run the app's executable in Terminal (i.e. Test.app/Contents/MacOS/test) directly, it works - If I do the same without sudo, I get the output: system.privilege.taskport acquired com.apple.TextEdit pid is 2475 Failed; machErr=(os/kern) failure (5)
- If I run the .app bundle by double-clicking in Finder, or in Terminal using "open Test.app" or "sudo open Test.app" it also fails in the same way.
So in the failure cases I'm told that I do have system.privilege.taskport rights, but task_for_pid() then fails. What vital step am I missing?
Many thanks if you can help,
Ben Staveley-Taylor ben.staveley-taylor@oracle.com
Code: -----
ProcessSerialNumber psn;
// Get pid of TextEdit, assuming it is running NSString *targetProcessBundle = @"com.apple.TextEdit"; if (FindPSNForBundleID(targetProcessBundle, &psn) == noErr) {
// I don't think this should be necessary, but done for verification OSStatus osErr = AcquireTaskportRight();
if (osErr == noErr) { // Convert PSN to PID. pid_t pid; GetProcessPID( &psn, &pid ); NSLog(@"%@ pid is %d", targetProcessBundle, pid);
mach_port_t remoteTask = 0; mach_error_t machErr = task_for_pid( mach_task_self(), pid, &remoteTask );
if (machErr == 0) { NSLog(@"Success"); } else { const char *msg = mach_error_string(machErr); NSLog(@"Failed; machErr=%s (%d)", msg, (int)machErr); } } }
OSStatus AcquireTaskportRight() {
OSStatus stat = noErr; AuthorizationItem taskport_item[] = { {"system.privilege.taskport"},0,0,0 }; AuthorizationRights rights = {1, taskport_item}, *out_rights = NULL; AuthorizationRef authRef; AuthorizationFlags auth_flags = kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize;
stat = AuthorizationCreate (NULL, kAuthorizationEmptyEnvironment, auth_flags, &authRef);
if (stat == errAuthorizationSuccess) { stat = AuthorizationCopyRights ( authRef, &rights, kAuthorizationEmptyEnvironment, auth_flags, &out_rights); }
if (stat == errAuthorizationSuccess) { NSLog(@"system.privilege.taskport acquired"); } else { NSLog(@"Failed to acquire system.privilege.taskport right. Error: %d", (int)stat); }
return stat; }
_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/thakis%40chromium.org
This email sent to thakis@chromium.org
_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... This email sent to site_archiver@lists.apple.com