https://github.com/trilemma-dev/SecureXPC
A simple and secure XPC framework for Swift
https://github.com/trilemma-dev/SecureXPC
machservices macos smjobbless swift xpc
Last synced: 6 months ago
JSON representation
A simple and secure XPC framework for Swift
- Host: GitHub
- URL: https://github.com/trilemma-dev/SecureXPC
- Owner: trilemma-dev
- License: mit
- Created: 2021-10-08T13:40:16.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2023-06-27T13:11:29.000Z (almost 2 years ago)
- Last Synced: 2024-11-17T17:38:13.897Z (7 months ago)
- Topics: machservices, macos, smjobbless, swift, xpc
- Language: Swift
- Homepage:
- Size: 564 KB
- Stars: 78
- Watchers: 6
- Forks: 15
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Use pure Swift to easily and securely communicate with XPC services and Mach services. A client-server model enables you
to use your own [`Codable`](https://developer.apple.com/documentation/swift/codable) conforming types to send requests
to routes you define and receive responses.
SecureXPC uses [Swift concurrency](https://docs.swift.org/swift-book/LanguageGuide/Concurrency.html) on macOS 10.15 and
later allowing clients to make non-blocking asynchronous requests to servers. A closure-based API is also available
providing compatibility back to OS X 10.10.
This package can be used to communicate with any type of XPC service or Mach service, with customized support for:
- [XPC services](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html)
- Helper tools installed using
[`SMJobBless`](https://developer.apple.com/documentation/servicemanagement/1431078-smjobbless)
- Login items enabled with
[`SMLoginItemSetEnabled`](https://developer.apple.com/documentation/servicemanagement/1501557-smloginitemsetenabled)
- Daemons registered via
[`SMAppService.daemon(plistName:)`](https://developer.apple.com/documentation/servicemanagement/smappservice/3945410-daemon)
- Agents registered via
[`SMAppService.agent(plistName:)`](https://developer.apple.com/documentation/servicemanagement/smappservice/3945409-agent)
It's built with security in mind, minimizing the opportunities for
[exploits](https://objectivebythesea.com/v3/talks/OBTS_v3_wReguła.pdf). Security checks are performed against the actual
calling process instead of relying on PIDs which are known to be
[insecure](https://saelo.github.io/presentations/warcon18_dont_trust_the_pid.pdf).
[](https://swiftpackageindex.com/trilemma-dev/SecureXPC)
# Usage
The envisioned pattern when using this package is to define routes in a shared file, create a server in one program
(such as a helper tool) and register these routes, then from another program (such as an app) create a client and send
requests to these routes.
## Routes
In a file shared by the client and server define one or more routes:
```swift
let route = XPCRoute.named("bedazzle")
.withMessageType(String.self)
.withReplyType(Bool.self)
```
## Server
In one program retrieve a server, register those routes, and then start the server:
```swift
...
let server = <# server retrieval here #>
server.registerRoute(route, handler: bedazzle)
server.startAndBlock()
}
private func bedazzle(message: String) throws -> Bool {
<# implementation here #>
}
```
On macOS 10.15 and later `async` functions and closures can also be registered as the handler for a route.
There are multiple types of servers which can be retrieved:
- `XPCServer.forThisXPCService()`
- For an XPC service, which is a private helper tool available only to the main application that contains it
- `XPCServer.forMachService()`
- For agents and daemons registered with `SMAppService`, `SMJobBless` helper tools, and `SMLoginItemSetEnabled`
login items
- `XPCServer.forMachService(withCriteria:)`
- For any type of Mach service including "classic" agents and daemons; see documentation for details
- `XPCServer.makeAnonymous()`
- Typically used for testing purposes
- `XPCServer.makeAnonymous(withClientRequirements:)`
- Enables advanced scenarios including apps directly communicating with each other; see documentation for details
## Client
In another program retrieve a client, then send a request to a registered route:
```swift
let client = <# client retrieval here #>
let reply = try await client.sendMessage("Get Schwifty", to: route)
```
Closure-based variants are available for macOS 10.14 and earlier:
```swift
let client = <# client retrieval here #>
client.sendMessage("Get Schwifty", to: route, withResponse: { result in
switch result {
case .success(let reply):
<# use the reply #>
case .failure(let error):
<# handle the error #>
}
})
```
There are three types of clients which can be retrieved:
- `XPCClient.forXPCService(named:)`
- For communicating with an XPC service
- This corresponds to servers created with `XPCServer.forThisXPCService()`
- `XPCClient.forMachService(named:withServerRequirement:)`
- For communicating with a Mach service
- This corresponds to servers created with `XPCServer.forMachService()` or
`XPCServer.forMachService(withCriteria:)`
- `XPCClient.forEndpoint(_:withServerRequirement:)`
- This is the only way to communicate with an anonymous server
- This corresponds to servers created with `XPCServer.makeAnonymous()` or
`XPCServer.makeAnonymous(withClientRequirements:)`
- This type of client can also be used to communicate with any server via its `endpoint` property
---
# Questions you may have
See the [FAQ](FAQ.md) for answers to questions you may have or didn't even realize you wanted answered including topics
such as using live file handles, sharing memory between processes, and working within sandbox restrictions.