SecureXPC

0.8.0

A simple and secure XPC framework for Swift
trilemma-dev/SecureXPC

What's New

0.8.0

2022-07-25T12:11:12Z

This is a big release! Continued thanks to @amomchilov for his contributions and code reviews.

New functionality

  • Adds built-in support for macOS Ventura's new SMAppService's daemons & agents.
    • For simple configurations, just call XPCServer.forMachService() and an auto-configured server will be returned.
  • Experimental support for shared memory has been added. Shared memory is truly shared between processes, no encoding or decoding occurs like with typical XPC communication.
    • A friendly to use, although quite basic, data structure SharedTrivial demonstrates this functionality.
    • The building block pieces available through SharedSemaphore, SharedMemory, and SharedRawMemory should enable you to build your own custom multi-process data structures.
    • This support is experimental and while it remains experimental breaking changes to it will not be considered for SerVer purposes.
  • XPCClient now provides the unforgeable identity of the server it is connected to via its serverIdentity async property (or the equivalent callback function).
  • XPCClient now automatically verifies the identity of the server in common cases and this can be customized with XPCClient.ServerRequirement.
  • XPCServer instances now always have an endpoint property (previously only those also conforming to XPCNonBlockingServer had this property).
  • Send IOSurface instances over XPC connections using the IOSurfaceForXPC property wrapper.
  • Data instances and arrays of trivial types can optionally be more efficiently sent across XPC connections by using the DataOptimizedForXPC and ArrayOptimizedForXPC property wrappers.

Breaking changes

  • XPCServer retrieval has been simplified. There are now just three main entry points:
    • XPCServer.forThisXPCService()
    • XPCServer.forMachService()
    • XPCServer.makeAnonymous()
  • XPCServer retrieval is now more customizable.
    • To customize a Mach service use XPCServer.MachServiceCriteria then call XPCServer.forMachService(withCriteria:)
    • To customize an anonymous server use XPCServer.makeAnonymous(withClientRequirement:)
  • XPCServer's client requirements no longer require using SecRequirement directly (although that's still supported).
    • Requirements are now created using XPCServer.ClientRequirement and declarative in nature: XPCServer.makeAnonymous(withClientRequirement: try .sameTeamIdentifier || try .teamIdentifier("Q55ZG849VX"))
  • XPCClient's factory methods have been tweaked to now optionally take a XPCClient.ServerRequirement instance.
  • XPCFileDescriptorContainer has been replaced by the FileHandleForXPC and FileDescriptorForXPC property wrappers.
  • XPCRequestContext has been renamed to XPCServer.ClientIdentity.
  • Several XPCError cases have been removed and a few have been added.
  • The underlying interprocess communication protocol between the client and server has changed (to support the client's ability to verify the server's identity). This means if you update SecureXPC, you need to do so for both your client and server implementations at the same time.

Use pure Swift to easily and securely communicate with XPC services and XPC Mach services. A client-server model enables you to use your own Codable conforming types to send requests to routes you define and receive responses.

SecureXPC uses Swift concurrency on macOS 10.15 and later allowing clients to make non-blocking asynchronous requests to servers. A closure-based API is also available providing compatibility back to OS X 10.10.

This framework is ideal for communicating with helper tools installed via SMJobBless and login items installed via SMLoginItemSetEnabled. It's built with security in mind, minimizing the opportunities for exploits. Server-side security checks are performed against the actual calling process instead of relying on PIDs which are known to be insecure.

Recommendation: If you are using SMJobBless helper tools, also check out Blessed.

Usage

The envisioned pattern when using this framework is to define routes in a shared file, create a server in one program (such as a helper tool) and register these routes, then from another program (such as an app) create a client and send requests to these routes.

Routes

In a file shared by the client and server define one or more routes:

let route = XPCRoute.named("bedazzle")
                    .withMessageType(String.self)
                    .withReplyType(Bool.self)

Server

In one program retrieve a server, register those routes, and then start the server:

    ...
    let server = <# server retrieval here #>
    server.registerRoute(route, handler: bedazzle)
    server.startAndBlock()
}

private func bedazzle(message: String) throws -> Bool {
     <# implementation here #>
}

On macOS 10.15 and later async functions and closures can also be registered as the handler for a route.

There are multiple types of servers which can be retrieved:

  • XPCServer.forThisXPCService()
    • For an XPC service, which is a private helper tool available only to the main application that contains it
  • XPCServer.forThisBlessedHelperTool()
  • XPCServer.forThisLoginItem()
  • XPCServer.forThisMachService(named:clientRequirements:)
  • XPCServer.makeAnonymous()
    • Typically used for testing purposes
  • XPCServer.makeAnonymous(clientRequirements:)
    • Enables applications not managed by launchd to communicate with each other, see documentation for more details

Client

In another program retrieve a client, then send a request to a registered route:

let client = <# client retrieval here #>
let reply = try await client.sendMessage("Get Schwifty", to: route)

Closure-based variants are available for macOS 10.14 and earlier:

let client = <# client retrieval here #>
client.sendMessage("Get Schwifty", to: route, withResponse: { result in
    switch result {
        case .success(let reply):
            <# use the reply #>
        case .failure(let error):
            <# handle the error #>
    }
})

There are multiple types of clients which can be retrieved:

  • XPCClient.forXPCService(named:)
    • For communicating with an XPC service
    • This corresponds to servers created with XPCServer.forThisXPCService()
  • XPCClient.forMachService(named:)
    • For communicating with an XPC Mach service
    • This corresponds to servers created with XPCServer.forThisBlessedHelperTool(), XPCServer.forThisLoginItem(), and XPCServer.forThisMachService(named:clientRequirements:)
  • XPCClient.forEndpoint(_:)
    • This is the only way to communicate with an anonymous server
    • This corresponds to servers created with XPCServer.makeAnonymous() or XPCServer.makeAnonymous(clientRequirements:)
    • It can also be used with an XPC Mach service

Questions you may have

See the FAQ for answers to questions you may have or didn't even realize you wanted answered.

Description

  • Swift Tools 5.5.0
View More Packages from this Author

Dependencies

  • None
Last updated: Fri Dec 02 2022 00:43:09 GMT-0500 (GMT-05:00)