I'm building a tool for admins in the enterprise context. The app needs to do some things as root, such as executing a script. I was hoping to implement a workflow where the user clicks a button, then will be shown the authentication prompt, enter the credentials and then execute the desired action. However, I couldn't find a way to implement this. AuthorizationExecuteWithPrivileges looked promising, but that's deprecated since 10.7. I've now tried to use a launch daemon that's contained in the app bundle with XPC, but that seems overly complicated and has several downsides (daemon with global machservice and the approval of a launch daemon suggests to the user that something's always running in the background). Also I'd like to stream the output of the executed scripts in real time back to the UI which seems very complicated to implement in this fashion. Is there a better way to enable an app to perform authorized privilege escalation for certain actions? What about privileged helper tools? I couldn't find any documentation about them. I know privilege escalation is not allowed in the App Store, but that's not relevant for us.

I'm looking at the JSON of an .ips crash report on macOS 12.3. "uptime" : 21000, "procLaunch" : "2022-03-28 12:12:34.0643 +0200", "procRole" : "Unspecified", "version" : 2, "userID" : 0, "deployVersion" : 210, "modelCode" : "MacBookPro18,1", "procStartAbsTime" : 514306295821, "coalitionID" : 2566, "osVersion" : { "train" : "macOS 12.3", "build" : "21E230", "releaseType" : "User" }, "captureTime" : "2022-03-28 12:12:45.1086 +0200", "incident" : "3B40D69B-0019-46D7-AD93-B73D02A4B636", "bug_type" : "309", "pid" : 17162, "procExitAbsTime" : 514570783723, I was expecting the field procStartAbsTime and procExitAbsTime to be UNIX timestamps, but that would result in dates in 1986. What format are they and how can they be converted? Also I noticed that BigSur creates both the old .crash and the new .ips format crash reports, even for the exact same crash, not at the same time though. So one time it creates a .crash, the next time an .ips.

macOS Sonoma 14.4 Xcode 15.3 Hi, I'm experimenting with C++/Swift interop and am following the official documentation, especially the section "Using Swift APIs of Imported Framework Target". I'm able to call Swift code from C++ when both Swift and C++ source files belong to the same app bundle or framework target, by importing the -Swift.h header. However, I'm not able to import the Swift code from a framework using a different C++ target. This is my test project setup: testApp is my app bundle and subprocesses is my framework, containing the auto-generated and unchanged subprocesses.h and some example swift code with a single public function. The subprocesses framework is added as a dependency to testApp and the framework has the C++ interoperability enabled. But when I try to import the auto-generated -Swift.h in main.cpp, it doesn't show up. What do I need to do so that I can call Swift framework code in a different C++ target? I think I've done everything according to the documentation. Thanks! Addendum I've also experimented with Apple's Xcode example projects. The "Mixing Languages in an Xcode project" (Link) works as expected. I was able to add a command line app target, and when I add the Fibonacci framework as a dependency, I'm able to use #include <Fibonacci/Fibonacci-Swift.h> and access the Swift API. However, the second of Apple's examples, "Calling APIs Across Language Boundaries" (Link) fails to compile out of the box (No member named 'createForest' in 'ForestBuilder::MagicForest').

I need to generate a compile_commands.json for our C++ project. I need it for static code analysis tools as well as enabling clangd usage with other editors. I've tried two methods but it only works for some files with clangd. The logs of the clangd extension in VS Code indicate only that many files can't be compiled. If it works for a file, it's great, but sadly it's not consistent. I've used these two approaches to generate the compile_commands.json: using xcpretty xcrun xcodebuild -projectmyproject.xcodeproj -scheme myscheme clean build CODE_SIGNING_ALLOWED=NO | xcpretty -r json-compilation-database -o build/compile_commands.json the recommended way by sonarcloud xcrun xcodebuild -project myproject.xcodeproj -scheme myscheme \ -configuration Debug clean build CODE_SIGNING_ALLOWED=NO OTHER_CFLAGS="\$(inherited) -gen-cdb-fragment-path \$(PROJECT_DIR)/CompilationDatabase" sed -e '1s/^/[\'$'\n''/' -e '$s/,$/\'$'\n'']/' MacOS/Source/CompilationDatabase/*.json > MacOS/Source/compile_commands.json Is there something missing or are there better ways to generate the compile_commands.json without having to write a full cmake definition?

The pidversion of a process with the same pid can increase during its lifetime. Which events, other than exec calls, can cause this increase in the pidversion? In other words, to what Endpoint Security events, other than fork, exec and exit, do I have to subscribe to get a process's complete and traceable pidversion history?

Our customers are large enterprises and we need to be able to collect traces on our customers' endpoints in support cases. Especially critical are performance problems. So far we've instructed our customers to use ktrace: sudo ktrace artrace -p appname --type=profile We would then open this trace in Instruments with the CPU profile and load our own symbols. The problem is, that symbols for system libraries are missing. In one instance we see that all of the high load is coming from a syscall made by libpcap. But all symbols other than our own are missing. How can we collect traces which include those symbols? I tried to use ktrace symbolicate in tests where I recorded a trace and then used ktrace symbolicate to collect system lib symbols, but it fails for most libraries, including libpcap and the syscalls. This is somewhat surprising, because dyld_info -exports /usr/lib/libpcap.A.dylib is able to print the symbols including offsets. So what is the recommended workflow for this scenario? Installing Xcode is of course not an option on a customer machine, especially not in an enterprise scenario.