bazelbuild / bazelbuild/rules_apple

Debugging Entitlements are disabled on macOS

Open
#2,535 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Starlark
Stars
593
Forks
334
Avg merge
16h 48m
Merged PRs (30d)
9

Description

[common_info.md](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/doc/common_info.md?plain=1#L129) lists under `Debugging Entitlement Support` that one can enable the debugging entitlement via a `--define`. However, it does not say on which platforms it is enabled.

After some digging, at "top level", it only referenced by:
- [macos_application](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L223)
- [macos_bundle](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L527)
- [macos_extension](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L772)
- [macos_quick_look_plugin](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1047)
- [macos_kernel_extension](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1291)
- [macos_spotlight_importer](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1540)
- [macos_xpc_service](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1779)

Notably, `macos_command_line_application` is not on that list.

Digging further, these rules call [_process_entitlements](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/apple/internal/entitlements_support.bzl#L194), which in turn calls [_include_debug_entitlements](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/apple/internal/entitlements_support.bzl#L80), and skips macOS entirely.

The comment in `_include_debug_entitlements` clearly says that it is not used in macOS but does not indicate why. There is one concrete use case for it: Instruments profiling. Without the `get-task-allow` entitlement, you get binaries that throw mysterious "Failed to gain Authorization" (or occasionally the even weirder "Required kernel recording resources are in use by another document.") errors.
- [StackOverflow](https://stackoverflow.com/questions/77266659/failed-to-gain-authorization-when-using-instruments)
- [Apple Developer Forum workaround](https://developer.apple.com/forums/thread/681687?answerId=677562022)
- [Detailed blog post on the workaround](https://cocoaphony.micro.blog/2022/10/29/solving-required-kernel.html)

I have confirmed that the workaround works with both `macos_command_line_application` and even `cc_binary`.

Contributor guide

Open the contributing guide

Research direction

Start with doc/common_info.md and apple/internal/entitlements_support.bzl, then trace _process_entitlements and _include_debug_entitlements through the macOS rules in apple/internal/macos_rules.bzl. Check how macos_command_line_application and cc_binary differ from the listed rules, and verify the intended Instruments use case. Done means the supported macOS targets can obtain the debugging entitlement without the documented authorization failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos
Domain
build-system, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.