fix: inspect macOS processes when ps is sandboxed - #2377
Draft
janicduplessis wants to merge 5 commits into
Draft
Conversation
Member
|
The source-level ownership checks remain fail-closed, and the reported sandbox tests cover the main identity cases. Before marking this ready, please verify the fallback from a clean installed package with ps blocked: the C source is copied separately, while its lookup is relative to the emitted JavaScript module. This needs a built-package check, not just source-checkout evidence. Please also confirm that the recorded iOS artifact is nonempty and playable, as #2376 requires. CI has not reported checks yet. |
Author
|
I think this is a bit too crazy of a fix for an edge case like this, looking into alternatives |
Author
|
Made this to help getting unique pids, could be useful here to remove some of the ps usage. https://github.com/appandflow/unique-pid |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
macOS sandboxes can block the setuid
psbinary even when process-inspection APIs are available. This prevents recording from establishing durable process identity and can leave cleanup unable to verify its owner.On macOS, failed
psqueries now fall back to a small lazily compiled helper. First use requires Xcode Command Line Tools and can add up to five seconds. The helper checks same-user process identity around argument capture, excludes environment data, and preserves start-time formatting. Unavailable compiler or denied APIs remain unverified; cleanup is not weakened. Other platforms and successfulpscalls are unchanged.Ten files change, including one existing test corrected to use a real exited child instead of assuming PID 101 is absent. Closes #2376.
Validation
Tested
2bae1154d171841f34bdc1fdfaf5362680be8c85on macOS arm64. Real sandbox tests cover PID identity, zombies, empty arguments, environment boundaries, protected files, and denied APIs. Independent code/design review is clear.Verified sandboxed recording, Settings screenshot, session close, and daemon cleanup on an owned iOS simulator. Record to local scratch storage before copying artifacts.
pnpm check:affected --runpasses on the named head. CI has not run.