---
title: "Check who is calling before a privileged · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/privileged-helper-callers
id: DSK-28
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1235
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check who is calling before a privileged helper acts

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Installs and local privileges](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DSK-28
- Level: Required
- Chapter: [Installs and local privileges](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges.md)
- Rule: A helper or service that runs as root or SYSTEM accepts connections only from your own signed app, or from the signed-in users on Windows. It performs only actions from a fixed list, with checked arguments.
- Check: A test signs a small program with another identity and connects it to the helper, which refuses it. A process from a network logon opens the Windows pipe and is refused. A request with an unknown action, or with a path outside the app's own folders, is refused.
- Risk: An account or system taken over
- How: Apps install helpers to update themselves or change system settings, and the helper has more rights than the user. If any local program can talk to it, malware gets those rights just by asking. On macOS 13 and later, `NSXPCConnection.setCodeSigningRequirement` refuses a peer that does not match your bundle ID and team ID. On Windows, a named pipe made without a security descriptor gives read access to Everyone and the anonymous account. Give the pipe a descriptor that allows only System and interactive users. Each request names one action from the list, never a path or a command to run as root. [Never pass input to a shell](https://agentwranglers.se/playbook/application-security/input-and-injection/command-injection.md) explains why. Mac App Store apps may not ask for root at all, under App Review Guideline 2.4.5(v).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```swift
let callerRequirement = "anchor apple generic and identifier \"com.example.ledgerly\" and certificate leaf[subject.OU] = \"ABCDE12345\""

func listener(_ listener: NSXPCListener, shouldAcceptNewConnection connection: NSXPCConnection) -> Bool {
    connection.setCodeSigningRequirement(callerRequirement)
    connection.exportedInterface = NSXPCInterface(with: HelperProtocol.self)
    connection.exportedObject = Helper()
    connection.resume()
    return true
}
```

### Plain text example 2

```csharp
var security = new PipeSecurity();
security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), PipeAccessRights.FullControl, AccessControlType.Allow));
security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.InteractiveSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));

using var pipe = NamedPipeServerStreamAcl.Create("ledgerly-helper", PipeDirection.InOut, 1,
    PipeTransmissionMode.Message, PipeOptions.Asynchronous, 0, 0, security);
```

## Sources

- [Apple, NSXPCConnection setCodeSigningRequirement](https://developer.apple.com/documentation/foundation/nsxpcconnection/setcodesigningrequirement%28_:%29)
- [Microsoft, Named Pipe Security and Access Rights](https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights)

## Related rules

- DSK-27 [Load libraries only from folders attackers cannot write](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/safe-library-loading.md) in Desktop apps and extensions
- APS-4 [Never pass input to a shell](https://agentwranglers.se/playbook/application-security/input-and-injection/command-injection.md) in Application security
- DSK-29 [Start at login only after the user turns it on](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/login-item-consent.md) in Desktop apps and extensions

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/privileged-helper-callers">Agent Wranglers desktop apps and extensions playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Load libraries only from folders attackers cannot write](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/safe-library-loading.md)
- Next: [Start at login only after the user turns it on](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges/login-item-consent.md)
- [Installs and local privileges](https://agentwranglers.se/playbook/desktop-apps/installs-and-local-privileges.md)