macOS sandbox blocks ps-backed recording process identity
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- ios, macos, node.js, typescript
- Domain
- devtools, mobile, operating-systems
Research direction
Start at the shared host-process module and trace readProcessStartTime and readProcessCommand into simctl recordVideo startup. On macOS, inspect the existing /bin/ps path and the required native probe, including bounded parsing and preserved argument boundaries. Done means sandbox, malformed-input, ownership, and recording start/stop tests pass with a playable artifact while non-macOS behavior remains unchanged.
Written by the indexing model from the issue text.
Description
Purpose
Allow iOS simulator recording to establish and verify process ownership inside a macOS sandbox that refuses execution of /bin/ps.
Reproduction
Run a synthetic Node child-process identity query under sandbox-exec -p '(version 1)(allow default)'. On macOS where /bin/ps is setuid, its execution is refused. readProcessStartTime and readProcessCommand return null, and recording startup can fail with simctl recordVideo did not expose a complete process identity.
The shared host-process module currently shells out to ps. A non-privileged native probe using proc_pidinfo(PROC_PIDTBSDINFO) and sysctl(KERN_PROCARGS2) can read the same owned child under this policy. PROC_PIDTBSDINFO needs a nonzero argument to include zombie processes.
Required behavior
- Keep command/start-time ownership checks and fail closed when identity cannot be proven; do not replace ownership with PID liveness alone.
- Bound native reads and preserve argument boundaries before rendering the existing command string.
- Detect changed start identity, zombie state, permission refusal, and exited processes.
- Package the native implementation without a global installation and keep non-macOS behavior unchanged.
Completion evidence
Real sandbox tests on synthetic owned children, malformed/bounded parsing tests, and iOS recording start/stop with a nonempty playable artifact. No benchmark transcripts or private run results are needed.
- Dominant language
- TypeScript
- Stars
- 4.7k
- Forks
- 304
- Avg merge
- 11h 29m
- Merged PRs (30d)
- 514
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from callstack/agent-device
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
callstack/agent-device#1869 ·
-
needs-triage
Difficulty 5/5 Over a week Newbie friendliness 32/100
callstack/agent-device#2948 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
callstack/agent-device#2946 ·
-
needs-triage
Difficulty 4/5 3-5 days Newbie friendliness 45/100
callstack/agent-device#2940 ·
-
bug ready-for-agent
Difficulty 5/5 Over a week Newbie friendliness 35/100
callstack/agent-device#2935 ·
All issues in callstack/agent-device
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
bcgov/bc-wallet-mobile#4761 · 1 comment ·
-
external-issue to-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
refactor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100