NEURLFilter / SimpleURLFilter: neagent fails to open URL prefilter mmap file with errno 13 Permission denied

App & System Services Networking
fix_parrot OP
Created 5d
Replies 7
Boosts 2
Views 230
Participants 4

I am testing NEURLFilter on macOS using the SimpleURLFilter sample, and I am seeing a failure from neagent while it is saving the local URL prefilter Bloom filter to its mmap file.

The relevant log is:

neagent	+[NEBloomFilter mmapToFile:data:dataLength:numberOfBits:numberOfHashes:murmurSeed:tag:]: NEBloomFilter - failed to open mmap file /private/var/db/urlPrefilter/com.apple.networkextension.url-prefilter-data.temp.com.example.apple-samplecode.SimpleURLFilterTC3Q7MAJXF <errno 13 - Permission denied>
neagent	<NEAgentURLFilterExtension: 0xc8ce64280>: -[NEAgentURLFilterExtension startURLFilter]_block_invoke - Failed to save first fetch of pre-filter data

Environment:

  • macOS: 26.5.1 (25F80)
  • Xcode: 26.5 (17F42)
  • Platform: macOS
  • Signing type: Apple Development (automatically manage signing)

What I am doing:

  1. Build and run the containing app.
  2. Save and enable the NEURLFilterManager configuration.
  3. The URL filter provider starts.
  4. The provider's prefilter code is reached.
  5. neagent logs the mmap failure above while trying to open a temporary file under /private/var/db/urlPrefilter.

Expected result:

neagent should be able to create or open its system-managed URL prefilter cache / mmap file under /private/var/db/urlPrefilter, and the local Bloom filter should be loaded successfully.

Actual result:

neagent fails to open the temporary mmap file with errno 13 Permission denied:

/private/var/db/urlPrefilter/com.apple.networkextension.url-prefilter-data.temp.<bundle/team-specific suffix>

I am not manually creating, modifying, or chmod/chown-ing /private/var/db/urlPrefilter or anything inside it. The directory and its contents are entirely system-managed. The failure appears to happen inside neagent while it is handling the system-managed URL prefilter cache.

The failure occurs at the mmapToFile: step while neagent saves the Bloom filter prefilter data.

Directory state:

drwxr-xr-x  2  root  wheel  64  /private/var/db/urlPrefilter

Has anyone else encountered this? Any suggestions on what could cause neagent to fail with errno 13 on its own mmap file under /private/var/db/urlPrefilter?

Answered by fix_parrot in 894779022

I checked KayleeSC's suggestion and found that all affected systems I tested are using a non-501 user ID. On the machine where I originally reproduced the issue, URL filtering works correctly for a UID 501 user.

Replies  7
Boosts  2
Views  230
Participants  4
DTS Engineer OP
Apple
4d

I know this sounds weird, but have you tried restarting?

There are two processes involved here — the system process hosting your filter provider and the NE agent process doing the actual work — which means that the system has to transfer access to the file between them. There are ways this can break down, especially on a development machine, that might cause an issue like this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

DTS Engineer OP
Apple
3d

It’s better to reply as a reply, rather than in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits.

Yes, I did. I restarted the machine, but the issue is still reproducible.

Oh well, it was a long shot (-:

Notably, someone else is reporting this problem. Are you working with ar_ivanov on this? If not, the fact that you’re both seeing it is clearly relevant.

In their post they mentioned that this is a regression, with things working correctly on macOS 26.3. Is that the case for you as well? Or have you not tried it on earlier systems?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
fix_parrot OP
3d

ar_ivanov and I discovered this issue independently.

I reproduced the issue on macOS 26.4.1 and continued to observe the same behavior after upgrading that machine to 26.5.1. The issue is also reproducible on a second machine running 26.5.1 and on another machine running 26.3.

All tested systems had SIP disabled and systemextensionsctl developer mode enabled. I also re-enabled SIP and checked the issue again after several subsequent reboots. The issue persisted.

I repeated the permissions change for /private/var/db/urlPrefilter/ described by ar_ivanov and observed the same behavior. The issue remained reproducible.
KayleeSC OP
3d

Hi!

If I guessed right the issue is: URL Filters break like that on macOS if the user ID is not 501. Reported this back in March in FB22281393.

My app detects this scenario and warns the user! But it’s a nightmare for them to actually change their user ID, so I’d love for this to get fixed eventually.
ameshkov OP
3d

The issue is ridiculous.

We also reported it in FB23265799, hopefully it will help prioritize it.

I actually think this is a critical bug. The assumption that "the current user is UID 501" only holds true for a single-user Mac that has never had its primary account deleted or recreated so URL filtering API is broken for all shared / family /corporate Macs, also probably reinstalled or migrated macOS might not work as well.
fix_parrot OP
8h
Recommended

I checked KayleeSC's suggestion and found that all affected systems I tested are using a non-501 user ID. On the machine where I originally reproduced the issue, URL filtering works correctly for a UID 501 user.

DTS Engineer OP
Apple
5h

Thanks for those bug reports (FB22281393, FB23265799).

On the machine where I originally reproduced the issue, URL filtering works correctly for a UID 501 user.

And thanks for that confirmation.

This is obviously problematic and I’ll make sure the NE team is aware of your bugs.

Curiously, if I’d tried this I would’ve noticed the problem immediately, because I always set up my Macs with an initial ‘root’ account and then create my quinn account on top of that. So quinn is always 502:

% id quinn
uid=502(quinn) …

However, I tend to run NE tests on iOS, so I never noticed this issue.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

NEURLFilter / SimpleURLFilter: neagent fails to open URL prefilter mmap file with errno 13 Permission denied
First post date Last post date
 
 
Q