disabling SIP makes it work in Xcode
Yowsers! If disabling SIP is the only answer, that’s something that Apple needs to fix. Personally, I only ever disable SIP on ‘victim’ machines.
I did some digging into this. To start, I can only reproduce this an Apple silicon; everything is fine on Intel.
I then updated my Apple silicon Mac to the latest (macOS 13.2, Xcode 14.2), just in case there have been recent changes. There have not.
Here’s how I reproduced this:
-
In Xcode, I chose File > New > Package.
-
I added the Package.swift
file to add this entry to the targets
array:
.executableTarget(name: "MyLibraryTool", dependencies: ["MyLibrary"]),
-
I created Sources/MyLibraryTool/main.swift
and edited it like so:
print("Hello Cruel World!")
-
I switched to the MyLibraryTool scheme and chose Product > Run. The app runs just fine.
-
I set a breakpoint on that print
statement and chose Product > Run again. It stopped at that breakpoint.
-
I clicked the Debug Memory Graph button. This triggered the Unable to acquire required task port
alert )-:
I then ran through roughly the same process with an Xcode project created from the macOS > Command Line Tool target. Things work in that case. So I compared the code signatures. Here’s the ‘native’ tool:
% codesign -d -vvv --entitlements - MyNativeTool
…
CodeDirectory v=20500 size=654 flags=0x10002(adhoc,runtime) …
…
Internal requirements count=0 size=12
[Dict]
…
[Key] com.apple.security.get-task-allow
[Value]
[Bool] true
And here’s the SwiftPM tool:
% codesign -d -vvv --entitlements - MyLibraryTool
…
CodeDirectory v=20400 size=550 flags=0x20002(adhoc,linker-signed) …
…
Internal requirements=none
Both tools are ad-hoc signed, which is what you’d expect on Apple silicon (all code on Apple silicon must be signed, so if you haven’t set up a signing identity then you get an ad-hoc signature, aka, Signed to Run Locally). The key difference is the presence of com.apple.security.get-task-allow
.
So, I re-signed the SwiftPM tool with that entitlement:
% cat tmp.entitlements
…
<dict>
<key>com.apple.security.get-task-allow</key>
<true/>
</dict>
</plist>
% codesign -s - --entitlements tmp.entitlements -o runtime MyLibraryTool
And back in Xcode I re-ran the app, but this time choosing Product > Perform Action > Run Without Building so that Xcode didn’t overwrite my signature. And now the Debug Memory Graph button works as expected.
This is clearly a bug. You wrote:
I opened FB11967056 for this one.
Thanks for that. I've added my findings to that bug.
In the meantime, I’m hoping that the above will let you re-enable SIP. ’cause, gosh, you really don’t want that off )-:
Share and Enjoy
Quinn “The Eskimo!” @ DTS @ Apple