Explore the core architecture of the operating system, including the kernel, memory management, and process scheduling.

Posts under Core OS subtopic

Post

Replies

Boosts

Views

Activity

Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
0
0
2.2k
Aug ’25
RLIMIT_AS across posix_spawn and exec on Apple silicon: documented guarantees?
What supported behaviour, if any, may applications rely on for inherited RLIMIT_AS when launching a process on macOS on Apple silicon using posix_spawn and subsequent exec transitions? An older published XNU header defines RLIMIT_AS: XNU resource.h (immutable revision) I am looking for the documented support and virtual-address-space accounting scope, including exclusions. For a finite limit already set in the launching process, does any documented guarantee cover the new process from its first executable or dynamic-loader mapping and across later exec transitions, or does the limit take effect at a later stage? If the limit cannot be applied, does launch abort before any target user code executes, what failure is reported, and can mappings occur before that failure? An explicit statement that this guarantee is not provided would also be helpful. My question concerns virtual address space, rather than resident memory or a language runtime's heap. A successful setter or getrlimit readback by itself does not answer when the limit takes effect. If an answer relies on published XNU code, what public release/build record would be needed to relate an immutable source revision to a released macOS build on Apple silicon, and what limits apply to that correspondence? I am asking about the supported public interface and publicly available documentation/source, without requesting private implementation details. A link to an existing answer or the documented boundary would be appreciated.
4
0
115
8m
WatchOS 27 throttles BLE discoveries
Hi! We have an app that highly depends on CoreBluetooth including scanning for peripherals with an advertised serviceUUID. Our app sets the CBCentralManagerScanOptionAllowDuplicatesKey flag to true while scanning. Receiving continuous discovery events about nearby devices is key to measure the RSSI before connecting. Updating some of our test devices to watchOS 27 we noticed that our app is broken. To analyze further we created a simple app to compare behavior between watchOS 26 and 27, and the difference is clear. On the 27 device it behaves like the flag is ignored and we only receive a couple of callbacks to centralManager(_:didDiscover:advertisementData:rssi:) then it stops. We could not find any documentation declaring this as a new restriction or something regarding that has changed. Is this a bug, or is there a way to get the old behavior on the new OS? The example app used for testing is available here: https://github.com/levente-gulyas-skidata/WatchBLEExperiments (Change the serviceUUID for testing if needed) Thank you, Levi
2
4
251
25m
Supported non-admin service identity for a macOS LaunchDaemon
I'm developing a private macOS application on an Apple-silicon Mac mini running macOS Golden Gate 27.2. I'm evaluating a system LaunchDaemon running under a dedicated, non-administrator identity that cannot log in interactively. A separate desktop application would communicate with the daemon through authenticated local IPC. Before implementing this architecture, I would like to establish the officially supported approach. My main question: What is the Apple-supported method for creating and maintaining a dedicated, non-administrator, non-interactive service identity for a system LaunchDaemon on macOS 27.2? In particular: Is there a documented procedure for creating, restricting, disabling, recovering and eventually removing this identity? Are dscl, sysadminctl or another account-management mechanism supported for this purpose? Can a LaunchDaemon run under this identity without an interactive user login, including when registered through SMAppService? Are there any secure-token, FileVault, volume-ownership or keychain restrictions that would affect this design? If a dedicated non-login service identity is not a supported architecture, what alternative does Apple recommend? I'd particularly appreciate links to official Apple documentation or guidance from Apple engineers. Thank you.
3
0
190
1h
Supported read/write handoff of a sandbox-container PNG to Preview using NSWorkspace
Hello, I am preparing an existing macOS screenshot utility for distribution through the Mac App Store. The app stores captured PNG files under its temporary directory: FileManager.default.temporaryDirectory .appendingPathComponent("ShelfDragPoC/Captures", isDirectory: true) A context-menu "Edit" action passes the original PNG URL to Preview using NSWorkspace. The app does not create an editing copy. Relevant code: import AppKit @MainActor func openInPreview(_ url: URL) { guard let previewURL = NSWorkspace.shared.urlForApplication( withBundleIdentifier: "com.apple.Preview" ) else { return } let configuration = NSWorkspace.OpenConfiguration() configuration.activates = true NSWorkspace.shared.open( [url], withApplicationAt: previewURL, configuration: configuration ) { _, _ in } } The app monitors the original PNG URL for file changes and refreshes its thumbnail when changes are detected. Observed behavior: In the existing non-sandboxed app, rotating an image in Preview updates the original PNG and the thumbnail without requiring Command-S. In the sandboxed validation app, Preview opens the image, but editing results in a separate copy. When closing the edited document, Preview displays a message indicating that the original document will not be changed. The original PNG and the app's thumbnail are not updated. The Preview launch code and file watcher are unchanged between the non-sandboxed and sandboxed versions. The sandboxed app has these entitlements: com.apple.security.app-sandbox com.apple.security.files.user-selected.read-write com.apple.security.files.bookmarks.app-scope The app-scoped bookmark is used for a separate Desktop export feature. The PNG opened in Preview remains in the app's sandbox container. My question: Is there a supported public API that allows a sandboxed Mac App Store app to open its own container-resident PNG in Preview with the permissions required for in-place editing and normal automatic saving? Ideally, the user would only need to select "Edit" once, without an additional file-selection dialog or an explicit Save command. We want to preserve the original PNG URL, keep App Sandbox enabled, and avoid automatically exporting temporary images to the Desktop. If this workflow is not supported, what is Apple's recommended approach? Thank you.
12
0
475
3h
iPhone 17 / iOS 27.2: BLE extended advertising discovery fails approximately 90–95% of the time
We are investigating a severe BLE extended-advertising discovery issue on an iPhone 17 running iOS 27.2 (24B119). The phone fails to discover our peripherals approximately 90–95% of the time, based on our testing estimate. On rare occasions discovery succeeds, and the peripheral can then be connected. We have filed FB25463740, with diagnostic captures and a comparison of successful and failing behavior. Earlier iOS behavior Extended-advertising discovery and connection worked without issues in our previous iOS 26 testing. Failures became apparent with iOS 27, with behavior varying by iPhone model. We do not have a verified iOS 26 baseline for this particular iPhone 17, so we are treating an OS regression as a possibility rather than a confirmed cause. Test configuration Affected phone: iPhone 17, iOS 27.2 (24B119). Working comparison: iPhone 16, also running iOS 27.2 (24B119). Advertising: extended advertising with a 1M primary PHY, 2M secondary PHY, and 31-byte advertising data. Scanning: nRF Connect in the foreground, without a service UUID filter. Both phones were near the same powered-on peripherals, with advertising configuration unchanged during the comparison. Observed behavior The iPhone 16 discovers the extended-advertising peripherals. The iPhone 17 usually does not, even while discovering other nearby BLE devices. Switching the peripherals to legacy advertising provides reliable discovery on the tested iPhone 17. When extended-advertising discovery does succeed, connection works. The issue reproduces in nRF Connect as well as our application. What the captures show During failing foreground scans, the iPhone 17 receives thousands of legacy advertising reports, but neither target peripheral appears in its HCI packet log. A later capture contains rare successful extended-advertising receptions from both peripherals. These reports contain the same 31-byte payloads received by the working iPhone 16 and identify the secondary PHY as 2M. That capture also records a successful connection using 2M in both directions. Successful and failing scans occur on the same iPhone 17 with identical checked scan-start command sequences. The commands complete successfully. This does not establish that all internal controller state is identical. Wi-Fi disconnection preceded one successful period, but repeating that action did not reproduce success. We have not established Wi-Fi coexistence or primary-to-auxiliary timing as the cause. Questions Has anyone observed similar extended-advertising discovery failures on iPhone 17 or other models running iOS 27? If so, which phone models, iOS builds, peripheral chipsets, and advertising PHYs are involved? Does legacy advertising remain reliable? Are there any known issues or supported workarounds for this behavior? For Apple engineering, FB25463740 includes captures covering both successful and failing periods that may help distinguish reception, auxiliary-channel scheduling, and reporting/filtering problems.
3
0
103
17h
macOS Open Directory: Does ODNodeCreateRecord cleanup preserve concurrent records?
We are designing a local, non-login service account provisioning process on macOS using the public Open Directory API. The documentation for ODNodeCreateRecord() states that if setting an initial attribute fails, the record is deleted and an error is returned. We need to ensure that a failed creation attempt cannot delete or modify a pre-existing record, including during concurrent record creation or replacement. Questions: When attribute initialization fails, is the internal cleanup guaranteed to target only the record instance created by that specific API call, rather than another record with the same name? Is this cleanup bound to a unique record identity or UUID, including if another process concurrently creates, removes, or replaces a record with the same name? Does the public API provide an atomic create-only guarantee that prevents changes to an existing record? If these guarantees are not provided, what supported API or provisioning approach should be used to avoid affecting pre-existing local Directory Services records? Our current plan uses the local /Local/Default Directory Services node for a dedicated service account, administrative change serialization, pre-creation collision checks, and post-operation identity verification. We understand that these checks do not themselves prove atomicity or race-free cleanup. We would appreciate clarification of the supported API guarantees, specifically for macOS 15. Thank you.
3
0
57
1d
Supported sandbox approach for cross-app window positioning and resizing
I am developing a macOS window-management utility for a new Mac App Store submission, targeting macOS 13+ on Apple silicon and supported Intel Macs. Its core function is to move and resize windows belonging to other, unmodified applications, in response to explicit menu commands, registered keyboard shortcuts, or optional edge-drag snapping. The current unsandboxed engineering implementation uses public Accessibility APIs: AXUIElementCreateApplication, AXUIElementCopyAttributeValue / AXUIElementCopyMultipleAttributeValues for window geometry, AXUIElementCopyElementAtPosition for drag targeting, and AXUIElementSetAttributeValue for AXPosition and AXSize. It requires explicit Accessibility consent. Window information is processed locally; the app does not transmit it. I understand that App Review Guideline 2.4.5(i) requires App Sandbox and that “Protecting user data with App Sandbox” lists assistive Accessibility API use as incompatible. The DTS answer in thread 789663 also explains that sandboxed apps cannot use Accessibility APIs, while noting that some use cases have alternatives. For this specific cross-application positioning/resizing use case: Is there a currently supported public API or documented, requestable entitlement that permits it in a newly submitted sandboxed Mac App Store app? If a supported alternative exists, what API/architecture and minimum OS requirements apply, including any approval process? If there is no supported route, can you confirm that this functionality cannot currently be delivered within the described sandboxed Mac App Store constraints? I am seeking a supported architecture for controlling other apps’ windows. The unsandboxed tests establish functionality only; they do not establish sandbox compatibility or App Review eligibility. References: https://developer.apple.com/app-store/review/guidelines/#hardware-compatibility https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox https://developer.apple.com/forums/thread/789663
5
0
148
1d
Supported quarantine-preservation contract for sandboxed file operations
Traverse is a sandboxed macOS file manager with user-selected read/write access. For an input already carrying the complete raw com.apple.quarantine value 0086;timestamp;agent;event, a fresh private copy may receive 0082 with the remaining fields equal. This asks about the input state, without claiming a verified creation recipe for the retained test file. Our security requirement is equality of the entire original raw value before and throughout the interval when the destination name is reachable, including interruption immediately after publication. Is there a documented, supported App Sandbox API or operation that guarantees this for (a) a same-volume, same-inode move from private staging to an absent user-selected name, (b) a new file or extracted ZIP member, and (c) native Trash followed by restoration? If so, what OS/volume/entitlement scope and exact guarantee apply, and can the raw flags and event field be preserved without removing or replacing an OS-assigned quarantine mark? If no such public contract exists, please confirm that raw byte equality cannot be claimed from quarantineProperties, FileManager.trashItem, NSWorkspace.recycle, NSFileCoordinator, rename, clone/copy, or post-operation readback alone. We are not requesting a bypass of quarantine or a weaker substitute for 0086.
1
0
44
1d
Critical Regression: smbfs 7.0 introduces a crtitical bug regarding symlinks
Apple feedback FB25355124 The SMB client no longer accepts reads to symlinks that are an absolute path to a network volume or a symlink that contains a (..) in the relative path. Reproduction steps on an SMB mount with this file structure: dir a.txt Run this command from inside of "dir": ln -s my-link ../dir/a.txt Attempt to read that symlink: cat ./my-link Which results in this error: cat: link: Invalid argument which is translating to an EINVAL getting returned from the SMB client. Same behavior was observed when making a symlink with an absolute path: ln -s my-link /Volumes/Example/dir/a.txt The server is responding successfully to the IOCTL command but the client is still rejecting the request with that error. This behavior was not observed in macOS 26.6.2 (smbfs 6.0.1) as well as previous versions of macOS.
4
5
312
1d
macOS 27/APFS: Supported ACL Absence Verification When acl_get_fd_np Returns ENOENT
Subject: Supported fail-closed ACL absence verification on macOS 27.0.1 / APFS Environment: macOS 27.0.1, build 26A434; APFS; installed macOS 27.0 SDK. We need a supported, documented way to determine whether an existing filesystem object has no effective ACL entries, while rejecting genuine retrieval failures and unsupported or unavailable ACL evidence. We are seeking clarification of the public interface contract, not alleging an Apple defect. For existing directory and regular-file fixtures, pathname metadata and descriptor metadata identify the same object. Errno is cleared immediately before each native call and captured immediately afterward. ACL retrieval uses ACL_TYPE_EXTENDED: acl_get_file(path, ACL_TYPE_EXTENDED) acl_get_fd_np(fd, ACL_TYPE_EXTENDED) On fresh objects, both return NULL with ENOENT. Explicit one-entry fixture ACLs are retrieved successfully. Explicit zero-entry fixture ACLs can also yield NULL/ENOENT, while attribute queries return a serialized zero-entry ACL. The attribute queries use getattrlist() and descriptor-bound fgetattrlist(), requesting ATTR_CMN_RETURNED_ATTRS | ATTR_CMN_EXTENDED_SECURITY, with FSOPT_NOFOLLOW | FSOPT_REPORT_FULLSIZE and WITHOUT FSOPT_PACK_INVAL_ATTRS. Buffer lengths, variable-reference bounds and returned-attribute validity are checked. For the existing directories of interest, both calls succeed but omit the ATTR_CMN_EXTENDED_SECURITY returned bit. Explicit populated and zero-entry fixture records do set the bit. APFS reports valid VOL_CAP_INT_EXTENDED_SECURITY support; we do not assume that volume capability proves per-object ACL availability. On macOS 27.0.1, build 26A434, using APFS, which supported interface and documented conditions allow software to distinguish an absent ACL from unavailable or unsupported ACL evidence when descriptor-bound attribute queries succeed but omit ATTR_CMN_EXTENDED_SECURITY and native ACL getters return ENOENT for an existing object? Please clarify: Whether ENOENT has a supported ACL-absence interpretation, and under exactly which checked conditions. Whether an omitted extended-security attribute can establish ACL absence, rather than unavailable or unsupported evidence. How explicit zero-entry ACLs differ from absent ACL records through supported interfaces. How KAUTH_FILESEC_NOACL should be interpreted through supported APIs. How genuine retrieval failures, including permission, I/O, allocation and unsupported-operation errors, must remain distinguishable. Whether a supported descriptor-bound verification method exists that preserves fail-closed security checks and object identity binding; please identify its guarantees and limitations regarding pathname/ancestor changes and later operations. Whether relevant behavior is specific to this macOS/APFS version. Please identify the applicable public documentation or supported verification sequence. We do not want to modify permissions, synthesize ACLs on target objects, treat invalid-attribute defaults as real evidence, or accept ambiguous omission/ENOENT as success. Existing ownership, mode and confinement checks must remain separate mandatory checks. If no public API can make this distinction reliably, please state that limitation.
10
0
383
1d
Hard aggregate process-tree memory enforcement on macOS
Is there a publicly supported macOS API, entitlement, or framework capable of enforcing a hard 64 MiB aggregate memory ceiling across a process tree, including its supervisor, observer, and descendants? Enforcement must be established before workload execution, survive fork/exec, and remain effective if the controlling process crashes. We have examined per-process resource limits and process-memory reporting, but these do not establish the required aggregate guarantee. If supported, which API and enforcement mechanism should we use? If not, is there a documented platform limitation?
1
0
33
1d
BNNSNDArrayDescriptor rejects manually calculated strides?
Supporse, in a tight loop, I want to matrix MxP with PxN to get MxN (in rowNum x colNum convention). The call to BNNSNDArrayDescriptor.init(data:shape:) always fails if I (correctly) specify all the strides. /* The simplest and fastest matmul(A,B) is when both A and B are in inner- dimension-major order - with the size P dimension stored continuous. i.e. A*(B^T) when A,B are stored in C-like row-major order, or, first-dimension-major order, but first index is the row index, like BLAS */ import Accelerate // Different sizes, so incorrectly-ordered sizes/strides/indices generate error let M: Int = 16 let N: Int = 8 let P: Int = 32 let sizeA = BNNS.Shape.matrixFirstMajor(M, P, stride: (0, 0)) // OK: stride:(1, 0) // bad: stride:(0, 1) -- Matmul failed, because 1 is given to the wrong dimension: should be at least P // stride:(1, P) -- Failed to create BNNSNDArrayDescriptor??? let sizeB = BNNS.Shape.matrixFirstMajor(N, P, stride: (0, 0)) // OK: stride:(1, 0) bad: stride:(0, 1), stride:(1, P) let sizeC = BNNS.Shape.matrixFirstMajor(M, N, stride: (0, 0)) // OK: stride:(1, 0) bad: stride:(0, 1), stride:(1, N) let Mat1 = UnsafeMutableRawBufferPointer .allocate(byteCount: (M+N)*P*4, alignment: 128) .initializeMemory(as: Float.self, repeating: 1.234) let Mat2 = UnsafeMutableRawBufferPointer .allocate(byteCount: M*N*4, alignment: 128) .initializeMemory(as: Float.self, repeating: 0.0) guard let descA = BNNSNDArrayDescriptor( data: Mat1.extracting(0..<M*P), shape: sizeA), let descB = BNNSNDArrayDescriptor( data: Mat1.extracting(M*P..<(M+N)*P), shape: sizeB), let descC = BNNSNDArrayDescriptor( data: Mat2, shape: sizeC) else { print("Failed to create BNNSNDArrayDescriptor."); exit(1) } print(descA) // workspaceSize = BNNS.matrixMultiplicationWorkspaceSize(...) // withUnsafeTemporaryAllocation(byteCount: workspaceSize, alignment: ...) { wksp in var iter = 0 while iter < 1000{ do { try BNNS.applyMatrixMultiplication( inputA: descA, transposed: false, inputB: descB, transposed: true, output: descC, alpha: 1.0, workspace: /*wksp*/ nil) } catch { // Probably got the dimensions backwards, so two matrices are not multiplicable print("Matmul failed: \(error)") break } iter += 1 }I guess in the Swift overlay, the verifying initializer checked a wrong arrangement of stride[k] >= size[k-1] * stride[k-1]. These RowMajor FirstMajor, etc. with all different size and index orderings, are surely confusing. bnns_constants.h:1394 gives the right description. PS: Please don't educate me about deprecation of BNNS. context.executeFunction(arguments: [Aptr, Bptr, Cptr]) is nearly 5x slower for this one-matmul-in-a-tight-loop case, and there's no way to reuse the underlying graph in another thread yet, not withBNNSGraph.Builder. The (im)practical alternative is calling sgemm() that is even more verbose than this.
2
0
108
1d
FileManager.default.contentsOfDirectory fails with SMB
Hi, I am trying to list the contents of a directory selected by the user using the following code: let documentPicker = UIDocumentPickerViewController(forOpeningContentTypes: [.folder]) documentPicker.delegate = self self.present(documentPicker, animated: true) func documentPicker(_ controller: UIDocumentPickerViewController, didPickDocumentsAt urls: [URL]) {         guard let folderUrl = urls.first else {return} let startAccessing&#9;= folderUrl.startAccessingSecurityScopedResource()         guard startAccessing else { print("ERROR")             return         }         defer {             if startAccessing {                 folderUrl.stopAccessingSecurityScopedResource()             }         }         var error : NSError? = nil         NSFileCoordinator().coordinate(readingItemAt: folderUrl, error: &error) { (url) in             let startAccessing = url.startAccessingSecurityScopedResource()             guard startAccessing else {                 print("ERROR 2")                 return             }             defer {                 if startAccessing { folderUrl.stopAccessingSecurityScopedResource()                 }             }                          do {                 let files = try FileManager.default.contentsOfDirectory(at: url, includingPropertiesForKeys: [.nameKey])                 print(files)             } catch let filesError {                 print(filesError)             }         }     } This works for iCloud and for local files. It also, curiously, works on empty folders on the SMB server (though, obviously, it returns an empty array). However, for SMB folders with contents I get the following cryptic error message. Error Domain=NSCocoaErrorDomain Code=256 "The file “downloads” couldn’t be opened." UserInfo={NSURL=file:///private/var/mobile/Library/LiveFiles/com.apple.filesystems.smbclientd/Gabgugfiles/downloads, NSFilePath=/private/var/mobile/Library/LiveFiles/com.apple.filesystems.smbclientd/Gabgugfiles/downloads, NSUnderlyingError=0x28010b0c0 {Error Domain=NSPOSIXErrorDomain Code=10006 "Unknown error: 10006"}} In addition, modifying the code slightly so the user picks an image instead works just fine too. I can load the image from the supplied URL. I have read the documentation here - https://developer.apple.com/documentation/uikit/view_controllers/providing_access_to_directories and watched the WWDC 2019 presentation, What's New in File Management and Quicklook, where this was introduced but this hasn't turned up any answers. My app is set up with Supports Document Browser. Is there something I'm doing wrong? The way this is described what I'm trying to do, get a list of files and act on each of them, is exactly what this is intended for yet it's not working.
12
0
3.5k
1d
UGreen NAS - Unable to enumerate contents of directory on iOS, works on macOS
I have a UGreen NAS. My app can read the contents of a folder on the NAS from macOS, but it cannot read the contents of a folder from iOS. I bring up a UIDocumentPickerViewController(forOpeningContentTypes: [UTType.folder], asCopy: false). I can pick a folder on the iPad’s internal storage, and successfully enumerate its contents. On the UGreen, I can pick a folder, but the content enumeration always returns zero items (no errors). Enumeration of the UGreen works from macOS. It also works on the iPad when connecting to a Mac mini, or a Synology NAS. . Files.app is able to view the UGreen folder and its contents. Oddly, my app cannot enumerate the contents, but it IS able to write a file to that UGreen folder. Since Files.app can enumerate and I can write to the UGreen folder (and I can enumerate contents on other servers) - how can I get the enumeration to work? Feedback is FB22955130
13
0
890
1d
NFC (ISO7816)- Tag Connection Lost IPhone 15 & 16 variants
NFC reading starts but after BAC, during the reading of DG2 the NFC stops reading and returns with Tag connection Lost error . It almost fails everytime on iPhone 15 Pro max with the following error. What's the solution for this? This is really important because our app entirely relies on the NFC data to proceed forward. This always fails in iPhone 15 & 16. Same card works fine on older iPhone models. What change should we do or include for the newer models. Error Domain=NFCError Code=102 "Tag response error / no response" UserInfo={NSLocalizedDescription=Tag response error / no response, NSUnderlyingError=0x303bd6af0 {Error Domain=nfcd Code=29 "Tag Error" UserInfo={NSLocalizedDescription=Tag Error, NSUnderlyingError=0x303bd6910 {Error Domain=com.apple.nfstack Code=20 "No response from tag" UserInfo={NSLocalizedDescription=No response from tag}}}}}
3
1
1.6k
1d
Does the macOS 27 disk image release guidance also apply to USB mass storage?
Thanks for your answer about disk images after guest shutdown. You mentioned that on macOS 27 and later, the host should be able to use the image once guestDidStop(_:) fires. Does that also apply to a writable RAW image opened by URL with VZDiskImageStorageDeviceAttachment and presented to the guest as a VZUSBMassStorageDevice? I’m testing with UTM 5.0.8 on an Apple silicon Mac running macOS 27.0.1 (build 26A434). In my test, lsof showed an Apple Virtualization process holding the image open for read/write while the guest was running. After a graceful shutdown, ejecting the image in UTM, and quitting UTM, lsof showed no match. I’m trying to work out when a separate host process can safely read the file. For this kind of attachment, is guestDidStop(_:) enough, or does the app also need to wait for VZUSBController.detach to complete? Can a separate process running without elevated privileges verify that the framework is done with that file, or does it need the app hosting the VM to report that the relevant callback fired?
1
0
263
2d
launchctl bootout fails for my own LaunchAgent: “caller is not allowed to signal target process”
I maintain a per-user LaunchAgent on my own Mac. Its plist is in ~/Library/LaunchAgents, and the service is registered in gui/501. When my development tool invoked launchctl bootout, it exited with status 1. The macOS log said: “caller (PID 14105) is not allowed to signal target process.” I verified that the service label, domain, and plist matched the running agent. The agent is still running. What requirements must the calling process meet to stop and re-register a LaunchAgent in the logged-in user’s GUI domain? Is there a read-only way to identify which restriction caused this denial before attempting to stop the service again?
1
0
57
2d
IRK-resolvable BLE advertisements stops after screen turns off
Device and software: iPhone model: iPhone 15 Pro iOS 27 Public Beta 6 Build: 24A5430a BLE receivers: two independent ESP32's IRK has worked reliably on iOS 26 and past versions. Observed behavior: With the iPhone display on both BLE receivers detect advertisements that resolve correctly using the enrolled IRK. No more than 10 seconds after the display is turned off, the IRK-resolvable advertisements stop. The IRK identity returns immediately when a notification wakes the display or when I manually do. Bluetooth itself remains active while this happens. The receivers continue to see several strong advertisements from the phone with some unidentified rotating addresses. The unidentified addresses rotate periodically and cannot be associated with the enrolled IRK. Additional observations: When my Apple Watch is powered on and connected, the iPhone remains IRK-detectable while the screen is off. It stops again when watch is disconnected. Connecting Bluetooth headphones does not have the same effect. The IRK-resolvable advertisement stops even while music continues playing. Moving the affected phone between two receivers confirmed that the unidentified rotating advertisements physically followed the phone. The existing IRK remains valid because it resolves the phone again immediately whenever the display wakes. I couldnt find any intentional IRK, private-address or screen-off advertising change documented in the iOS 27 release notes or any discussions online. Has anyone else observed this on iOS 27?
1
0
308
3d
FSKit External-Volume Mount Fails During Removable Volumes TCC Authorization
Summary A minimal read-only FUSE-T filesystem cannot be mounted over a newly created, empty directory on an external APFS volume. FSKit reaches the LIFSv2 mount stage, but the final mount(2) returns EPERM. In the same timestamp window, sandboxd requests kTCCServiceSystemPolicyRemovableVolumes on behalf of root /usr/libexec/fskitd. The request is forwarded to com.apple.tccd.system, but TCC logs an invalid XPC connection and sends an empty reply with no auth_value. sandboxd then reports the missing authorization value and denies the request; fskitd immediately reports mount(2) error 1. No user-facing consent prompt appears. This looks like an authorization handoff or policy-integration failure in the system FSKit mount path, rather than a denial returned by the filesystem implementation. The exact reason com.apple.tccd.system returns an invalid or empty reply is unknown. Environment ItemValueTest date/time2026-11-06, approximately 18:47:31 CETMacApple silicon (arm64)macOS27.2, build 26B123FUSE-T receiptsorg.fuse-t.core.1.2.9, org.fuse-t.fskit.1.2.9Registered FSKit extensionorg.fuset.fskit-srv.module, version 0.1.3FUSE-T library/Library/Application Support/fuse-t/lib/libfuse-t-1.2.9.dylibTarget volumeWDBlack4TB, /dev/disk8s1; case-sensitive APFS; owners enabled; read/write; diskutil reports Protocol: PCI-Express and Device Location: ExternalMount pointNewly created, empty directory on the target volume; owned by logged-in user (UID 501), mode 0700Minimal reproduction Enable/register the FUSE-T FSKit extension using its normal installation flow. Build or use a minimal read-only FUSE filesystem whose callbacks expose only the root directory and one static hello.txt file. The fixture used here was linked directly to FUSE-T 1.2.9 and did not read backing files or modify the target volume. As the logged-in user (UID 501; no sudo), create a new empty directory on an external APFS volume. Start a bounded unified-log capture for fskitd, sandboxd, and tccd, then run: ./hello -f -o backend=fskit <empty-directory-on-external-volume> Observe the mount failure and preserve the same-window logs. Actual result The FUSE process exits 1 and prints: fuse: mount failed with error: -1. No mount is created at the test path. fskitd finds/starts the FSKit extension instance and reaches “will mount over LIFSv2”. The final mount(2) fails with errno 1 (EPERM / “Operation not permitted”). The TCC events below occur at the same timestamp as the mount(2) error. No permission prompt is shown to the logged-in user. Timestamp-correlated attribution and authorization evidence At 18:47:31.793, fskitd enters the LiveFS mount path. At 18:47:31.801, tccd records the relevant attribution chain: accessing={TCCDProcess: identifier=com.apple.fskitd, pid=36573, auid=0, euid=0, binary_path=/usr/libexec/fskitd} requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=472, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}At 18:47:31.824, TCC logs a platform-binary prompting policy of Deny. In this trace that message is associated with a separate SystemPolicyAllFiles check; the All Files result is not being presented as the final Removable Volumes denial. At 18:47:31.829, sandboxd checks kTCCServiceSystemPolicyRemovableVolumes for fskitd. Because the audit token has auid=-1, sandboxd routes the authorization request based on euid 0 to com.apple.tccd.system. The request includes fskitd’s audit token (pid 36573, auid -1, euid 0). The system tccd endpoint returns an invalid XPC connection / an empty reply without auth_value. The relevant messages are: sandboxd: checking kTCCServiceSystemPolicyRemovableVolumes for fskitd sandboxd: auid = -1; routing based on euid (0) instead tccd: REQUEST ... tccd_uid=0 ... service=kTCCServiceSystemPolicyRemovableVolumes sandboxd: RECV ... { count = 0 ... contents = } sandboxd: Error ... Code=2 "missing 'auth_value' in reply message" tccd: XPC forwardMessage error: Connection invalid tccd: sending empty reply ... auth_value absent sandboxd: kTCCServiceSystemPolicyRemovableVolumes denied by TCC for fskitd fskitd: mount(2) error: 1 fskitd: mount launch failed with result "Operation not permitted"The same EPERM/TCC failure was seen in earlier diagnostic attempts and again in this fresh invocation; this run provides the full timestamp-correlated attribution capture. It happens before a successful mount. The captured report contains the exact log lines selected from the bounded unified-log stream. Expected behavior / questions for Apple Is kTCCServiceSystemPolicyRemovableVolumes expected to authorize the final LIFSv2 mount performed by fskitd when a client asks to mount over a directory on external APFS? For a root system daemon with auid=-1, should sandboxd route this request to com.apple.tccd.system? Why does that endpoint return an invalid connection / empty reply rather than an authorization result? What is the supported authorization flow for this case? Should a user-consent prompt be shown to the initiating application, or should the system broker authorize fskitd using the caller’s audit token or security-scoped destination access? If this mount operation is unsupported by design, could the documentation or returned error distinguish that policy from a generic EPERM? Impact FSKit-based user-space filesystems cannot mount into an existing folder on this external APFS volume, despite the empty mountpoint being owned by the user and despite the FSKit extension loading successfully. This blocks applications that must expose a virtual filesystem at the user-selected original folder. The failure is in the system mount / authorization path; the minimal filesystem does not implement writes or access external backing data. Limitations This reproduction establishes the behavior on one Apple-silicon Mac, macOS 27.2 (26B123), FUSE-T 1.2.9, and one external APFS volume. It does not establish whether this is a general macOS defect, a machine-specific TCC daemon condition, or an intentional policy with a broken authorization response. The cause of com.apple.tccd.system’s invalid XPC reply remains unknown.
1
0
102
4d
Core OS Resources
General: DevForums subtopic: App & System Services > Core OS Core OS is a catch-all subtopic for low-level APIs that don’t fall into one of these more specific areas: Processes & Concurrency Resources Files and Storage Resources Networking Resources Network Extension Resources Security Resources Virtualization Resources Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"
Replies
0
Boosts
0
Views
2.2k
Activity
Aug ’25
RLIMIT_AS across posix_spawn and exec on Apple silicon: documented guarantees?
What supported behaviour, if any, may applications rely on for inherited RLIMIT_AS when launching a process on macOS on Apple silicon using posix_spawn and subsequent exec transitions? An older published XNU header defines RLIMIT_AS: XNU resource.h (immutable revision) I am looking for the documented support and virtual-address-space accounting scope, including exclusions. For a finite limit already set in the launching process, does any documented guarantee cover the new process from its first executable or dynamic-loader mapping and across later exec transitions, or does the limit take effect at a later stage? If the limit cannot be applied, does launch abort before any target user code executes, what failure is reported, and can mappings occur before that failure? An explicit statement that this guarantee is not provided would also be helpful. My question concerns virtual address space, rather than resident memory or a language runtime's heap. A successful setter or getrlimit readback by itself does not answer when the limit takes effect. If an answer relies on published XNU code, what public release/build record would be needed to relate an immutable source revision to a released macOS build on Apple silicon, and what limits apply to that correspondence? I am asking about the supported public interface and publicly available documentation/source, without requesting private implementation details. A link to an existing answer or the documented boundary would be appreciated.
Replies
4
Boosts
0
Views
115
Activity
8m
WatchOS 27 throttles BLE discoveries
Hi! We have an app that highly depends on CoreBluetooth including scanning for peripherals with an advertised serviceUUID. Our app sets the CBCentralManagerScanOptionAllowDuplicatesKey flag to true while scanning. Receiving continuous discovery events about nearby devices is key to measure the RSSI before connecting. Updating some of our test devices to watchOS 27 we noticed that our app is broken. To analyze further we created a simple app to compare behavior between watchOS 26 and 27, and the difference is clear. On the 27 device it behaves like the flag is ignored and we only receive a couple of callbacks to centralManager(_:didDiscover:advertisementData:rssi:) then it stops. We could not find any documentation declaring this as a new restriction or something regarding that has changed. Is this a bug, or is there a way to get the old behavior on the new OS? The example app used for testing is available here: https://github.com/levente-gulyas-skidata/WatchBLEExperiments (Change the serviceUUID for testing if needed) Thank you, Levi
Replies
2
Boosts
4
Views
251
Activity
25m
Supported non-admin service identity for a macOS LaunchDaemon
I'm developing a private macOS application on an Apple-silicon Mac mini running macOS Golden Gate 27.2. I'm evaluating a system LaunchDaemon running under a dedicated, non-administrator identity that cannot log in interactively. A separate desktop application would communicate with the daemon through authenticated local IPC. Before implementing this architecture, I would like to establish the officially supported approach. My main question: What is the Apple-supported method for creating and maintaining a dedicated, non-administrator, non-interactive service identity for a system LaunchDaemon on macOS 27.2? In particular: Is there a documented procedure for creating, restricting, disabling, recovering and eventually removing this identity? Are dscl, sysadminctl or another account-management mechanism supported for this purpose? Can a LaunchDaemon run under this identity without an interactive user login, including when registered through SMAppService? Are there any secure-token, FileVault, volume-ownership or keychain restrictions that would affect this design? If a dedicated non-login service identity is not a supported architecture, what alternative does Apple recommend? I'd particularly appreciate links to official Apple documentation or guidance from Apple engineers. Thank you.
Replies
3
Boosts
0
Views
190
Activity
1h
Supported read/write handoff of a sandbox-container PNG to Preview using NSWorkspace
Hello, I am preparing an existing macOS screenshot utility for distribution through the Mac App Store. The app stores captured PNG files under its temporary directory: FileManager.default.temporaryDirectory .appendingPathComponent("ShelfDragPoC/Captures", isDirectory: true) A context-menu "Edit" action passes the original PNG URL to Preview using NSWorkspace. The app does not create an editing copy. Relevant code: import AppKit @MainActor func openInPreview(_ url: URL) { guard let previewURL = NSWorkspace.shared.urlForApplication( withBundleIdentifier: "com.apple.Preview" ) else { return } let configuration = NSWorkspace.OpenConfiguration() configuration.activates = true NSWorkspace.shared.open( [url], withApplicationAt: previewURL, configuration: configuration ) { _, _ in } } The app monitors the original PNG URL for file changes and refreshes its thumbnail when changes are detected. Observed behavior: In the existing non-sandboxed app, rotating an image in Preview updates the original PNG and the thumbnail without requiring Command-S. In the sandboxed validation app, Preview opens the image, but editing results in a separate copy. When closing the edited document, Preview displays a message indicating that the original document will not be changed. The original PNG and the app's thumbnail are not updated. The Preview launch code and file watcher are unchanged between the non-sandboxed and sandboxed versions. The sandboxed app has these entitlements: com.apple.security.app-sandbox com.apple.security.files.user-selected.read-write com.apple.security.files.bookmarks.app-scope The app-scoped bookmark is used for a separate Desktop export feature. The PNG opened in Preview remains in the app's sandbox container. My question: Is there a supported public API that allows a sandboxed Mac App Store app to open its own container-resident PNG in Preview with the permissions required for in-place editing and normal automatic saving? Ideally, the user would only need to select "Edit" once, without an additional file-selection dialog or an explicit Save command. We want to preserve the original PNG URL, keep App Sandbox enabled, and avoid automatically exporting temporary images to the Desktop. If this workflow is not supported, what is Apple's recommended approach? Thank you.
Replies
12
Boosts
0
Views
475
Activity
3h
iPhone 17 / iOS 27.2: BLE extended advertising discovery fails approximately 90–95% of the time
We are investigating a severe BLE extended-advertising discovery issue on an iPhone 17 running iOS 27.2 (24B119). The phone fails to discover our peripherals approximately 90–95% of the time, based on our testing estimate. On rare occasions discovery succeeds, and the peripheral can then be connected. We have filed FB25463740, with diagnostic captures and a comparison of successful and failing behavior. Earlier iOS behavior Extended-advertising discovery and connection worked without issues in our previous iOS 26 testing. Failures became apparent with iOS 27, with behavior varying by iPhone model. We do not have a verified iOS 26 baseline for this particular iPhone 17, so we are treating an OS regression as a possibility rather than a confirmed cause. Test configuration Affected phone: iPhone 17, iOS 27.2 (24B119). Working comparison: iPhone 16, also running iOS 27.2 (24B119). Advertising: extended advertising with a 1M primary PHY, 2M secondary PHY, and 31-byte advertising data. Scanning: nRF Connect in the foreground, without a service UUID filter. Both phones were near the same powered-on peripherals, with advertising configuration unchanged during the comparison. Observed behavior The iPhone 16 discovers the extended-advertising peripherals. The iPhone 17 usually does not, even while discovering other nearby BLE devices. Switching the peripherals to legacy advertising provides reliable discovery on the tested iPhone 17. When extended-advertising discovery does succeed, connection works. The issue reproduces in nRF Connect as well as our application. What the captures show During failing foreground scans, the iPhone 17 receives thousands of legacy advertising reports, but neither target peripheral appears in its HCI packet log. A later capture contains rare successful extended-advertising receptions from both peripherals. These reports contain the same 31-byte payloads received by the working iPhone 16 and identify the secondary PHY as 2M. That capture also records a successful connection using 2M in both directions. Successful and failing scans occur on the same iPhone 17 with identical checked scan-start command sequences. The commands complete successfully. This does not establish that all internal controller state is identical. Wi-Fi disconnection preceded one successful period, but repeating that action did not reproduce success. We have not established Wi-Fi coexistence or primary-to-auxiliary timing as the cause. Questions Has anyone observed similar extended-advertising discovery failures on iPhone 17 or other models running iOS 27? If so, which phone models, iOS builds, peripheral chipsets, and advertising PHYs are involved? Does legacy advertising remain reliable? Are there any known issues or supported workarounds for this behavior? For Apple engineering, FB25463740 includes captures covering both successful and failing periods that may help distinguish reception, auxiliary-channel scheduling, and reporting/filtering problems.
Replies
3
Boosts
0
Views
103
Activity
17h
macOS Open Directory: Does ODNodeCreateRecord cleanup preserve concurrent records?
We are designing a local, non-login service account provisioning process on macOS using the public Open Directory API. The documentation for ODNodeCreateRecord() states that if setting an initial attribute fails, the record is deleted and an error is returned. We need to ensure that a failed creation attempt cannot delete or modify a pre-existing record, including during concurrent record creation or replacement. Questions: When attribute initialization fails, is the internal cleanup guaranteed to target only the record instance created by that specific API call, rather than another record with the same name? Is this cleanup bound to a unique record identity or UUID, including if another process concurrently creates, removes, or replaces a record with the same name? Does the public API provide an atomic create-only guarantee that prevents changes to an existing record? If these guarantees are not provided, what supported API or provisioning approach should be used to avoid affecting pre-existing local Directory Services records? Our current plan uses the local /Local/Default Directory Services node for a dedicated service account, administrative change serialization, pre-creation collision checks, and post-operation identity verification. We understand that these checks do not themselves prove atomicity or race-free cleanup. We would appreciate clarification of the supported API guarantees, specifically for macOS 15. Thank you.
Replies
3
Boosts
0
Views
57
Activity
1d
Supported sandbox approach for cross-app window positioning and resizing
I am developing a macOS window-management utility for a new Mac App Store submission, targeting macOS 13+ on Apple silicon and supported Intel Macs. Its core function is to move and resize windows belonging to other, unmodified applications, in response to explicit menu commands, registered keyboard shortcuts, or optional edge-drag snapping. The current unsandboxed engineering implementation uses public Accessibility APIs: AXUIElementCreateApplication, AXUIElementCopyAttributeValue / AXUIElementCopyMultipleAttributeValues for window geometry, AXUIElementCopyElementAtPosition for drag targeting, and AXUIElementSetAttributeValue for AXPosition and AXSize. It requires explicit Accessibility consent. Window information is processed locally; the app does not transmit it. I understand that App Review Guideline 2.4.5(i) requires App Sandbox and that “Protecting user data with App Sandbox” lists assistive Accessibility API use as incompatible. The DTS answer in thread 789663 also explains that sandboxed apps cannot use Accessibility APIs, while noting that some use cases have alternatives. For this specific cross-application positioning/resizing use case: Is there a currently supported public API or documented, requestable entitlement that permits it in a newly submitted sandboxed Mac App Store app? If a supported alternative exists, what API/architecture and minimum OS requirements apply, including any approval process? If there is no supported route, can you confirm that this functionality cannot currently be delivered within the described sandboxed Mac App Store constraints? I am seeking a supported architecture for controlling other apps’ windows. The unsandboxed tests establish functionality only; they do not establish sandbox compatibility or App Review eligibility. References: https://developer.apple.com/app-store/review/guidelines/#hardware-compatibility https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox https://developer.apple.com/forums/thread/789663
Replies
5
Boosts
0
Views
148
Activity
1d
Supported quarantine-preservation contract for sandboxed file operations
Traverse is a sandboxed macOS file manager with user-selected read/write access. For an input already carrying the complete raw com.apple.quarantine value 0086;timestamp;agent;event, a fresh private copy may receive 0082 with the remaining fields equal. This asks about the input state, without claiming a verified creation recipe for the retained test file. Our security requirement is equality of the entire original raw value before and throughout the interval when the destination name is reachable, including interruption immediately after publication. Is there a documented, supported App Sandbox API or operation that guarantees this for (a) a same-volume, same-inode move from private staging to an absent user-selected name, (b) a new file or extracted ZIP member, and (c) native Trash followed by restoration? If so, what OS/volume/entitlement scope and exact guarantee apply, and can the raw flags and event field be preserved without removing or replacing an OS-assigned quarantine mark? If no such public contract exists, please confirm that raw byte equality cannot be claimed from quarantineProperties, FileManager.trashItem, NSWorkspace.recycle, NSFileCoordinator, rename, clone/copy, or post-operation readback alone. We are not requesting a bypass of quarantine or a weaker substitute for 0086.
Replies
1
Boosts
0
Views
44
Activity
1d
Critical Regression: smbfs 7.0 introduces a crtitical bug regarding symlinks
Apple feedback FB25355124 The SMB client no longer accepts reads to symlinks that are an absolute path to a network volume or a symlink that contains a (..) in the relative path. Reproduction steps on an SMB mount with this file structure: dir a.txt Run this command from inside of "dir": ln -s my-link ../dir/a.txt Attempt to read that symlink: cat ./my-link Which results in this error: cat: link: Invalid argument which is translating to an EINVAL getting returned from the SMB client. Same behavior was observed when making a symlink with an absolute path: ln -s my-link /Volumes/Example/dir/a.txt The server is responding successfully to the IOCTL command but the client is still rejecting the request with that error. This behavior was not observed in macOS 26.6.2 (smbfs 6.0.1) as well as previous versions of macOS.
Replies
4
Boosts
5
Views
312
Activity
1d
macOS 27/APFS: Supported ACL Absence Verification When acl_get_fd_np Returns ENOENT
Subject: Supported fail-closed ACL absence verification on macOS 27.0.1 / APFS Environment: macOS 27.0.1, build 26A434; APFS; installed macOS 27.0 SDK. We need a supported, documented way to determine whether an existing filesystem object has no effective ACL entries, while rejecting genuine retrieval failures and unsupported or unavailable ACL evidence. We are seeking clarification of the public interface contract, not alleging an Apple defect. For existing directory and regular-file fixtures, pathname metadata and descriptor metadata identify the same object. Errno is cleared immediately before each native call and captured immediately afterward. ACL retrieval uses ACL_TYPE_EXTENDED: acl_get_file(path, ACL_TYPE_EXTENDED) acl_get_fd_np(fd, ACL_TYPE_EXTENDED) On fresh objects, both return NULL with ENOENT. Explicit one-entry fixture ACLs are retrieved successfully. Explicit zero-entry fixture ACLs can also yield NULL/ENOENT, while attribute queries return a serialized zero-entry ACL. The attribute queries use getattrlist() and descriptor-bound fgetattrlist(), requesting ATTR_CMN_RETURNED_ATTRS | ATTR_CMN_EXTENDED_SECURITY, with FSOPT_NOFOLLOW | FSOPT_REPORT_FULLSIZE and WITHOUT FSOPT_PACK_INVAL_ATTRS. Buffer lengths, variable-reference bounds and returned-attribute validity are checked. For the existing directories of interest, both calls succeed but omit the ATTR_CMN_EXTENDED_SECURITY returned bit. Explicit populated and zero-entry fixture records do set the bit. APFS reports valid VOL_CAP_INT_EXTENDED_SECURITY support; we do not assume that volume capability proves per-object ACL availability. On macOS 27.0.1, build 26A434, using APFS, which supported interface and documented conditions allow software to distinguish an absent ACL from unavailable or unsupported ACL evidence when descriptor-bound attribute queries succeed but omit ATTR_CMN_EXTENDED_SECURITY and native ACL getters return ENOENT for an existing object? Please clarify: Whether ENOENT has a supported ACL-absence interpretation, and under exactly which checked conditions. Whether an omitted extended-security attribute can establish ACL absence, rather than unavailable or unsupported evidence. How explicit zero-entry ACLs differ from absent ACL records through supported interfaces. How KAUTH_FILESEC_NOACL should be interpreted through supported APIs. How genuine retrieval failures, including permission, I/O, allocation and unsupported-operation errors, must remain distinguishable. Whether a supported descriptor-bound verification method exists that preserves fail-closed security checks and object identity binding; please identify its guarantees and limitations regarding pathname/ancestor changes and later operations. Whether relevant behavior is specific to this macOS/APFS version. Please identify the applicable public documentation or supported verification sequence. We do not want to modify permissions, synthesize ACLs on target objects, treat invalid-attribute defaults as real evidence, or accept ambiguous omission/ENOENT as success. Existing ownership, mode and confinement checks must remain separate mandatory checks. If no public API can make this distinction reliably, please state that limitation.
Replies
10
Boosts
0
Views
383
Activity
1d
Hard aggregate process-tree memory enforcement on macOS
Is there a publicly supported macOS API, entitlement, or framework capable of enforcing a hard 64 MiB aggregate memory ceiling across a process tree, including its supervisor, observer, and descendants? Enforcement must be established before workload execution, survive fork/exec, and remain effective if the controlling process crashes. We have examined per-process resource limits and process-memory reporting, but these do not establish the required aggregate guarantee. If supported, which API and enforcement mechanism should we use? If not, is there a documented platform limitation?
Replies
1
Boosts
0
Views
33
Activity
1d
BNNSNDArrayDescriptor rejects manually calculated strides?
Supporse, in a tight loop, I want to matrix MxP with PxN to get MxN (in rowNum x colNum convention). The call to BNNSNDArrayDescriptor.init(data:shape:) always fails if I (correctly) specify all the strides. /* The simplest and fastest matmul(A,B) is when both A and B are in inner- dimension-major order - with the size P dimension stored continuous. i.e. A*(B^T) when A,B are stored in C-like row-major order, or, first-dimension-major order, but first index is the row index, like BLAS */ import Accelerate // Different sizes, so incorrectly-ordered sizes/strides/indices generate error let M: Int = 16 let N: Int = 8 let P: Int = 32 let sizeA = BNNS.Shape.matrixFirstMajor(M, P, stride: (0, 0)) // OK: stride:(1, 0) // bad: stride:(0, 1) -- Matmul failed, because 1 is given to the wrong dimension: should be at least P // stride:(1, P) -- Failed to create BNNSNDArrayDescriptor??? let sizeB = BNNS.Shape.matrixFirstMajor(N, P, stride: (0, 0)) // OK: stride:(1, 0) bad: stride:(0, 1), stride:(1, P) let sizeC = BNNS.Shape.matrixFirstMajor(M, N, stride: (0, 0)) // OK: stride:(1, 0) bad: stride:(0, 1), stride:(1, N) let Mat1 = UnsafeMutableRawBufferPointer .allocate(byteCount: (M+N)*P*4, alignment: 128) .initializeMemory(as: Float.self, repeating: 1.234) let Mat2 = UnsafeMutableRawBufferPointer .allocate(byteCount: M*N*4, alignment: 128) .initializeMemory(as: Float.self, repeating: 0.0) guard let descA = BNNSNDArrayDescriptor( data: Mat1.extracting(0..<M*P), shape: sizeA), let descB = BNNSNDArrayDescriptor( data: Mat1.extracting(M*P..<(M+N)*P), shape: sizeB), let descC = BNNSNDArrayDescriptor( data: Mat2, shape: sizeC) else { print("Failed to create BNNSNDArrayDescriptor."); exit(1) } print(descA) // workspaceSize = BNNS.matrixMultiplicationWorkspaceSize(...) // withUnsafeTemporaryAllocation(byteCount: workspaceSize, alignment: ...) { wksp in var iter = 0 while iter < 1000{ do { try BNNS.applyMatrixMultiplication( inputA: descA, transposed: false, inputB: descB, transposed: true, output: descC, alpha: 1.0, workspace: /*wksp*/ nil) } catch { // Probably got the dimensions backwards, so two matrices are not multiplicable print("Matmul failed: \(error)") break } iter += 1 }I guess in the Swift overlay, the verifying initializer checked a wrong arrangement of stride[k] >= size[k-1] * stride[k-1]. These RowMajor FirstMajor, etc. with all different size and index orderings, are surely confusing. bnns_constants.h:1394 gives the right description. PS: Please don't educate me about deprecation of BNNS. context.executeFunction(arguments: [Aptr, Bptr, Cptr]) is nearly 5x slower for this one-matmul-in-a-tight-loop case, and there's no way to reuse the underlying graph in another thread yet, not withBNNSGraph.Builder. The (im)practical alternative is calling sgemm() that is even more verbose than this.
Replies
2
Boosts
0
Views
108
Activity
1d
FileManager.default.contentsOfDirectory fails with SMB
Hi, I am trying to list the contents of a directory selected by the user using the following code: let documentPicker = UIDocumentPickerViewController(forOpeningContentTypes: [.folder]) documentPicker.delegate = self self.present(documentPicker, animated: true) func documentPicker(_ controller: UIDocumentPickerViewController, didPickDocumentsAt urls: [URL]) {         guard let folderUrl = urls.first else {return} let startAccessing&#9;= folderUrl.startAccessingSecurityScopedResource()         guard startAccessing else { print("ERROR")             return         }         defer {             if startAccessing {                 folderUrl.stopAccessingSecurityScopedResource()             }         }         var error : NSError? = nil         NSFileCoordinator().coordinate(readingItemAt: folderUrl, error: &error) { (url) in             let startAccessing = url.startAccessingSecurityScopedResource()             guard startAccessing else {                 print("ERROR 2")                 return             }             defer {                 if startAccessing { folderUrl.stopAccessingSecurityScopedResource()                 }             }                          do {                 let files = try FileManager.default.contentsOfDirectory(at: url, includingPropertiesForKeys: [.nameKey])                 print(files)             } catch let filesError {                 print(filesError)             }         }     } This works for iCloud and for local files. It also, curiously, works on empty folders on the SMB server (though, obviously, it returns an empty array). However, for SMB folders with contents I get the following cryptic error message. Error Domain=NSCocoaErrorDomain Code=256 "The file “downloads” couldn’t be opened." UserInfo={NSURL=file:///private/var/mobile/Library/LiveFiles/com.apple.filesystems.smbclientd/Gabgugfiles/downloads, NSFilePath=/private/var/mobile/Library/LiveFiles/com.apple.filesystems.smbclientd/Gabgugfiles/downloads, NSUnderlyingError=0x28010b0c0 {Error Domain=NSPOSIXErrorDomain Code=10006 "Unknown error: 10006"}} In addition, modifying the code slightly so the user picks an image instead works just fine too. I can load the image from the supplied URL. I have read the documentation here - https://developer.apple.com/documentation/uikit/view_controllers/providing_access_to_directories and watched the WWDC 2019 presentation, What's New in File Management and Quicklook, where this was introduced but this hasn't turned up any answers. My app is set up with Supports Document Browser. Is there something I'm doing wrong? The way this is described what I'm trying to do, get a list of files and act on each of them, is exactly what this is intended for yet it's not working.
Replies
12
Boosts
0
Views
3.5k
Activity
1d
UGreen NAS - Unable to enumerate contents of directory on iOS, works on macOS
I have a UGreen NAS. My app can read the contents of a folder on the NAS from macOS, but it cannot read the contents of a folder from iOS. I bring up a UIDocumentPickerViewController(forOpeningContentTypes: [UTType.folder], asCopy: false). I can pick a folder on the iPad’s internal storage, and successfully enumerate its contents. On the UGreen, I can pick a folder, but the content enumeration always returns zero items (no errors). Enumeration of the UGreen works from macOS. It also works on the iPad when connecting to a Mac mini, or a Synology NAS. . Files.app is able to view the UGreen folder and its contents. Oddly, my app cannot enumerate the contents, but it IS able to write a file to that UGreen folder. Since Files.app can enumerate and I can write to the UGreen folder (and I can enumerate contents on other servers) - how can I get the enumeration to work? Feedback is FB22955130
Replies
13
Boosts
0
Views
890
Activity
1d
NFC (ISO7816)- Tag Connection Lost IPhone 15 & 16 variants
NFC reading starts but after BAC, during the reading of DG2 the NFC stops reading and returns with Tag connection Lost error . It almost fails everytime on iPhone 15 Pro max with the following error. What's the solution for this? This is really important because our app entirely relies on the NFC data to proceed forward. This always fails in iPhone 15 & 16. Same card works fine on older iPhone models. What change should we do or include for the newer models. Error Domain=NFCError Code=102 "Tag response error / no response" UserInfo={NSLocalizedDescription=Tag response error / no response, NSUnderlyingError=0x303bd6af0 {Error Domain=nfcd Code=29 "Tag Error" UserInfo={NSLocalizedDescription=Tag Error, NSUnderlyingError=0x303bd6910 {Error Domain=com.apple.nfstack Code=20 "No response from tag" UserInfo={NSLocalizedDescription=No response from tag}}}}}
Replies
3
Boosts
1
Views
1.6k
Activity
1d
Does the macOS 27 disk image release guidance also apply to USB mass storage?
Thanks for your answer about disk images after guest shutdown. You mentioned that on macOS 27 and later, the host should be able to use the image once guestDidStop(_:) fires. Does that also apply to a writable RAW image opened by URL with VZDiskImageStorageDeviceAttachment and presented to the guest as a VZUSBMassStorageDevice? I’m testing with UTM 5.0.8 on an Apple silicon Mac running macOS 27.0.1 (build 26A434). In my test, lsof showed an Apple Virtualization process holding the image open for read/write while the guest was running. After a graceful shutdown, ejecting the image in UTM, and quitting UTM, lsof showed no match. I’m trying to work out when a separate host process can safely read the file. For this kind of attachment, is guestDidStop(_:) enough, or does the app also need to wait for VZUSBController.detach to complete? Can a separate process running without elevated privileges verify that the framework is done with that file, or does it need the app hosting the VM to report that the relevant callback fired?
Replies
1
Boosts
0
Views
263
Activity
2d
launchctl bootout fails for my own LaunchAgent: “caller is not allowed to signal target process”
I maintain a per-user LaunchAgent on my own Mac. Its plist is in ~/Library/LaunchAgents, and the service is registered in gui/501. When my development tool invoked launchctl bootout, it exited with status 1. The macOS log said: “caller (PID 14105) is not allowed to signal target process.” I verified that the service label, domain, and plist matched the running agent. The agent is still running. What requirements must the calling process meet to stop and re-register a LaunchAgent in the logged-in user’s GUI domain? Is there a read-only way to identify which restriction caused this denial before attempting to stop the service again?
Replies
1
Boosts
0
Views
57
Activity
2d
IRK-resolvable BLE advertisements stops after screen turns off
Device and software: iPhone model: iPhone 15 Pro iOS 27 Public Beta 6 Build: 24A5430a BLE receivers: two independent ESP32's IRK has worked reliably on iOS 26 and past versions. Observed behavior: With the iPhone display on both BLE receivers detect advertisements that resolve correctly using the enrolled IRK. No more than 10 seconds after the display is turned off, the IRK-resolvable advertisements stop. The IRK identity returns immediately when a notification wakes the display or when I manually do. Bluetooth itself remains active while this happens. The receivers continue to see several strong advertisements from the phone with some unidentified rotating addresses. The unidentified addresses rotate periodically and cannot be associated with the enrolled IRK. Additional observations: When my Apple Watch is powered on and connected, the iPhone remains IRK-detectable while the screen is off. It stops again when watch is disconnected. Connecting Bluetooth headphones does not have the same effect. The IRK-resolvable advertisement stops even while music continues playing. Moving the affected phone between two receivers confirmed that the unidentified rotating advertisements physically followed the phone. The existing IRK remains valid because it resolves the phone again immediately whenever the display wakes. I couldnt find any intentional IRK, private-address or screen-off advertising change documented in the iOS 27 release notes or any discussions online. Has anyone else observed this on iOS 27?
Replies
1
Boosts
0
Views
308
Activity
3d
FSKit External-Volume Mount Fails During Removable Volumes TCC Authorization
Summary A minimal read-only FUSE-T filesystem cannot be mounted over a newly created, empty directory on an external APFS volume. FSKit reaches the LIFSv2 mount stage, but the final mount(2) returns EPERM. In the same timestamp window, sandboxd requests kTCCServiceSystemPolicyRemovableVolumes on behalf of root /usr/libexec/fskitd. The request is forwarded to com.apple.tccd.system, but TCC logs an invalid XPC connection and sends an empty reply with no auth_value. sandboxd then reports the missing authorization value and denies the request; fskitd immediately reports mount(2) error 1. No user-facing consent prompt appears. This looks like an authorization handoff or policy-integration failure in the system FSKit mount path, rather than a denial returned by the filesystem implementation. The exact reason com.apple.tccd.system returns an invalid or empty reply is unknown. Environment ItemValueTest date/time2026-11-06, approximately 18:47:31 CETMacApple silicon (arm64)macOS27.2, build 26B123FUSE-T receiptsorg.fuse-t.core.1.2.9, org.fuse-t.fskit.1.2.9Registered FSKit extensionorg.fuset.fskit-srv.module, version 0.1.3FUSE-T library/Library/Application Support/fuse-t/lib/libfuse-t-1.2.9.dylibTarget volumeWDBlack4TB, /dev/disk8s1; case-sensitive APFS; owners enabled; read/write; diskutil reports Protocol: PCI-Express and Device Location: ExternalMount pointNewly created, empty directory on the target volume; owned by logged-in user (UID 501), mode 0700Minimal reproduction Enable/register the FUSE-T FSKit extension using its normal installation flow. Build or use a minimal read-only FUSE filesystem whose callbacks expose only the root directory and one static hello.txt file. The fixture used here was linked directly to FUSE-T 1.2.9 and did not read backing files or modify the target volume. As the logged-in user (UID 501; no sudo), create a new empty directory on an external APFS volume. Start a bounded unified-log capture for fskitd, sandboxd, and tccd, then run: ./hello -f -o backend=fskit <empty-directory-on-external-volume> Observe the mount failure and preserve the same-window logs. Actual result The FUSE process exits 1 and prints: fuse: mount failed with error: -1. No mount is created at the test path. fskitd finds/starts the FSKit extension instance and reaches “will mount over LIFSv2”. The final mount(2) fails with errno 1 (EPERM / “Operation not permitted”). The TCC events below occur at the same timestamp as the mount(2) error. No permission prompt is shown to the logged-in user. Timestamp-correlated attribution and authorization evidence At 18:47:31.793, fskitd enters the LiveFS mount path. At 18:47:31.801, tccd records the relevant attribution chain: accessing={TCCDProcess: identifier=com.apple.fskitd, pid=36573, auid=0, euid=0, binary_path=/usr/libexec/fskitd} requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=472, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}At 18:47:31.824, TCC logs a platform-binary prompting policy of Deny. In this trace that message is associated with a separate SystemPolicyAllFiles check; the All Files result is not being presented as the final Removable Volumes denial. At 18:47:31.829, sandboxd checks kTCCServiceSystemPolicyRemovableVolumes for fskitd. Because the audit token has auid=-1, sandboxd routes the authorization request based on euid 0 to com.apple.tccd.system. The request includes fskitd’s audit token (pid 36573, auid -1, euid 0). The system tccd endpoint returns an invalid XPC connection / an empty reply without auth_value. The relevant messages are: sandboxd: checking kTCCServiceSystemPolicyRemovableVolumes for fskitd sandboxd: auid = -1; routing based on euid (0) instead tccd: REQUEST ... tccd_uid=0 ... service=kTCCServiceSystemPolicyRemovableVolumes sandboxd: RECV ... { count = 0 ... contents = } sandboxd: Error ... Code=2 "missing 'auth_value' in reply message" tccd: XPC forwardMessage error: Connection invalid tccd: sending empty reply ... auth_value absent sandboxd: kTCCServiceSystemPolicyRemovableVolumes denied by TCC for fskitd fskitd: mount(2) error: 1 fskitd: mount launch failed with result "Operation not permitted"The same EPERM/TCC failure was seen in earlier diagnostic attempts and again in this fresh invocation; this run provides the full timestamp-correlated attribution capture. It happens before a successful mount. The captured report contains the exact log lines selected from the bounded unified-log stream. Expected behavior / questions for Apple Is kTCCServiceSystemPolicyRemovableVolumes expected to authorize the final LIFSv2 mount performed by fskitd when a client asks to mount over a directory on external APFS? For a root system daemon with auid=-1, should sandboxd route this request to com.apple.tccd.system? Why does that endpoint return an invalid connection / empty reply rather than an authorization result? What is the supported authorization flow for this case? Should a user-consent prompt be shown to the initiating application, or should the system broker authorize fskitd using the caller’s audit token or security-scoped destination access? If this mount operation is unsupported by design, could the documentation or returned error distinguish that policy from a generic EPERM? Impact FSKit-based user-space filesystems cannot mount into an existing folder on this external APFS volume, despite the empty mountpoint being owned by the user and despite the FSKit extension loading successfully. This blocks applications that must expose a virtual filesystem at the user-selected original folder. The failure is in the system mount / authorization path; the minimal filesystem does not implement writes or access external backing data. Limitations This reproduction establishes the behavior on one Apple-silicon Mac, macOS 27.2 (26B123), FUSE-T 1.2.9, and one external APFS volume. It does not establish whether this is a general macOS defect, a machine-specific TCC daemon condition, or an intentional policy with a broken authorization response. The cause of com.apple.tccd.system’s invalid XPC reply remains unknown.
Replies
1
Boosts
0
Views
102
Activity
4d