Hi Kevin
Thank you for you reply.
We have test ES_EVENT_TYPE_AUTH_IOKIT_OPEN on 26, and it does not block anything. We report the same issue in FB19420236.
I can see AUTH requests coming from system stats and airportd processes, I can deny them, yet when I plug a keyboard and do it, keyboard works without changes. I can see it console that my deny was received.
The events from a keyboard:
[2025-08-06 20:53:54.668478952] [1754513634668] ES_EVENT_TYPE_AUTH_IOKIT_OPEN == 91, v=10, seq_num=10, global_seq_num=20 - I(pid=365, path=/usr/sbin/systemstats, ppid=1, team_id=(null)),T=1, C=AppleUSBHostDeviceUserClient, RID=4305578448, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000
parent_registry_id=4305578448
| name = Gaming Keyboard | 04F3:2014 | OK
**** Sending ES_AUTH_RESULT_DENY **** seq_num=10, global_seq_num=20[2025-08-06 20:53:54.669013579] [1754513634669] ES_EVENT_TYPE_AUTH_IOKIT_OPEN == 91, v=10, seq_num=11, global_seq_num=21 - I(pid=469, path=/usr/libexec/airportd, ppid=1, team_id=(null)),T=1, C=AppleUSBHostDeviceUserClient, RID=4305578448, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000
parent_registry_id=4305578448
| name = Gaming Keyboard | 04F3:2014 | OK
**** Sending ES_AUTH_RESULT_DENY **** seq_num=11, global_seq_num=21[2025-08-06 20:53:54.668478952] [1754513634668] ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN == 24, v=10, seq_num=10, global_seq_num=22 - I(pid=365, path=/usr/sbin/systemstats, ppid=1, team_id=(null)),T=1, C=AppleUSBHostDeviceUserClient, RID=4305578448, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000
parent_registry_id=4305578448
| name = Gaming Keyboard | 04F3:2014 | OK
[2025-08-06 20:53:54.669013579] [1754513634669] ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN == 24, v=10, seq_num=11, global_seq_num=23 - I(pid=469, path=/usr/libexec/airportd, ppid=1, team_id=(null)),T=1, C=AppleUSBHostDeviceUserClient, RID=4305578448, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000
parent_registry_id=4305578448
| name = Gaming Keyboard | 04F3:2014 | OK
[2025-08-06 20:53:54.755309056] [1754513634755] ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN == 24, v=10, seq_num=12, global_seq_num=24 - I(pid=430, path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer, ppid=1, team_id=(null)),T=1702065507, C=IOHIDEventServiceUserClient, RID=4305578467, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000/IOUSBHostInterface@0/AppleUserUSBHostHIDDevice/IOHIDInterface/AppleUserHIDEventDriver
parent_registry_id=4305578467
| name = AppleUserHIDEventDriver | 0000:0000 | OK
[2025-08-06 20:53:54.777964868] [1754513634777] ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN == 24, v=10, seq_num=13, global_seq_num=25 - I(pid=430, path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer, ppid=1, team_id=(null)),T=1702065507, C=IOHIDEventServiceUserClient, RID=4305578475, RPATH=IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-hs@00100000/USB2.0 Hub@00100000/AppleUSB20Hub@00100000/AppleUSB20HubPort@00140000/Gaming Keyboard@00140000/IOUSBHostInterface@1/AppleUserUSBHostHIDDevice/IOHIDInterface/AppleUserHIDEventDriver
Topic:
App & System Services
SubTopic:
Drivers
Tags: