Check who is calling before a privileged helper acts

How to do it

Apps install helpers to update themselves or change system settings, and the helper has more rights than the user. If any local program can talk to it, malware gets those rights just by asking. On macOS 13 and later, NSXPCConnection.setCodeSigningRequirement refuses a peer that does not match your bundle ID and team ID. On Windows, a named pipe made without a security descriptor gives read access to Everyone and the anonymous account. Give the pipe a descriptor that allows only System and interactive users. Each request names one action from the list, never a path or a command to run as root. Never pass input to a shell explains why. Mac App Store apps may not ask for root at all, under App Review Guideline 2.4.5(v).

Examples

Plain text example

let callerRequirement = "anchor apple generic and identifier \"com.example.ledgerly\" and certificate leaf[subject.OU] = \"ABCDE12345\""

func listener(_ listener: NSXPCListener, shouldAcceptNewConnection connection: NSXPCConnection) -> Bool {
    connection.setCodeSigningRequirement(callerRequirement)
    connection.exportedInterface = NSXPCInterface(with: HelperProtocol.self)
    connection.exportedObject = Helper()
    connection.resume()
    return true
}

Plain text example 2

var security = new PipeSecurity();
security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), PipeAccessRights.FullControl, AccessControlType.Allow));
security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.InteractiveSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));

using var pipe = NamedPipeServerStreamAcl.Create("ledgerly-helper", PipeDirection.InOut, 1,
    PipeTransmissionMode.Message, PipeOptions.Asynchronous, 0, 0, security);

How to check

A test signs a small program with another identity and connects it to the helper, which refuses it. A process from a network logon opens the Windows pipe and is refused. A request with an unknown action, or with a path outside the app's own folders, is refused.

Sources

• Apple, NSXPCConnection setCodeSigningRequirement
• Microsoft, Named Pipe Security and Access Rights

Related rules

• DSK-27 Load libraries only from folders attackers cannot write in Desktop apps and extensions
• APS-4 Never pass input to a shell in Application security
• DSK-29 Start at login only after the user turns it on in Desktop apps and extensions