Documentation
¶
Overview ¶
Package process inspects App Sandbox status and code-signing entitlements for the current process and for arbitrary PIDs.
It offers two complementary paths: a csops(2) syscall path (no Objective-C runtime, safe to call from any goroutine) used by the *Self helpers, and the Security framework's SecTask APIs for richer queries. Process lookups fall back to reading the executable's static signature (see package codesign).
Index ¶
- Variables
- func CurrentEntitlementBoolSelf(key string) (bool, error)
- func CurrentTaskEntitlement(key string) (any, error)
- func CurrentTaskEntitlements(keys []string) (map[string]any, error)
- func HasCurrentTaskEntitlement(key string) (bool, error)
- func IsProcessSandboxed(pid int) (bool, error)
- func IsSandboxed() (bool, error)
- func IsSandboxedSelf() (bool, error)
- func ProcessApplicationGroups(pid int) ([]string, error)
- func ProcessEntitlement(pid int, key string) (any, error)
- func ProcessEntitlementBool(pid int, key string) (bool, error)
- func ProcessEntitlementString(pid int, key string) (string, error)
- func ProcessEntitlements(pid int, keys []string) (map[string]any, error)
Constants ¶
This section is empty.
Variables ¶
var ( // ErrInvalidPID is returned when a process identifier is not positive. ErrInvalidPID = errors.New("invalid pid") // ErrCSOps is returned when the csops(2) system call fails. ErrCSOps = errors.New("csops operation failed") )
Functions ¶
func CurrentEntitlementBoolSelf ¶
CurrentEntitlementBoolSelf reports whether the current process holds a Boolean entitlement, read via csops(2) (no Objective-C runtime). A missing entitlement returns (false, nil).
func CurrentTaskEntitlement ¶
CurrentTaskEntitlement returns the entitlement value for the current process.
func CurrentTaskEntitlements ¶
CurrentTaskEntitlements returns entitlement values for the given keys on the current process. Missing keys are omitted from the result map.
func HasCurrentTaskEntitlement ¶
HasCurrentTaskEntitlement reports whether the current process holds a Boolean entitlement. A missing entitlement returns (false, nil).
func IsProcessSandboxed ¶
IsProcessSandboxed reports whether pid runs with App Sandbox enabled. A missing entitlement returns (false, nil).
func IsSandboxed ¶
IsSandboxed reports whether the current process has App Sandbox enabled.
func IsSandboxedSelf ¶
IsSandboxedSelf reports whether the current process runs under the App Sandbox, determined from its code-signing entitlements via the csops(2) syscall.
Unlike IsSandboxed it does NOT use the Objective-C runtime (no SecTask, no main-thread dispatch). That makes it safe to call from code paths that themselves dispatch to the main thread — the SDK auto-dispatches @MainActor calls via dispatch_sync to the main queue, which would deadlock if the main thread is not draining it. A missing entitlement returns (false, nil).
func ProcessApplicationGroups ¶
ProcessApplicationGroups returns application group identifiers granted to pid.
func ProcessEntitlement ¶
ProcessEntitlement returns one runtime entitlement value for pid.
func ProcessEntitlementBool ¶
ProcessEntitlementBool reports whether pid holds a Boolean entitlement. A missing entitlement returns (false, nil).
func ProcessEntitlementString ¶
ProcessEntitlementString coerces a string entitlement for pid when present.
Types ¶
This section is empty.
Source Files