bazelbuild / bazelbuild/rules_apple
Debugging Entitlements are disabled on macOS
- Dominant language
- Starlark
- Stars
- 593
- Forks
- 334
- Avg merge
- 16h 48m
- Merged PRs (30d)
- 9
Description
[common_info.md](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/doc/common_info.md?plain=1#L129) lists under `Debugging Entitlement Support` that one can enable the debugging entitlement via a `--define`. However, it does not say on which platforms it is enabled.
After some digging, at "top level", it only referenced by:
- [macos_application](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L223)
- [macos_bundle](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L527)
- [macos_extension](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L772)
- [macos_quick_look_plugin](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1047)
- [macos_kernel_extension](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1291)
- [macos_spotlight_importer](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1540)
- [macos_xpc_service](https://github.com/bazelbuild/rules_apple/blob/00a55762b04d751bb6140904c3b038f6fa95a0d6/apple/internal/macos_rules.bzl#L1779)
Notably, `macos_command_line_application` is not on that list.
Digging further, these rules call [_process_entitlements](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/apple/internal/entitlements_support.bzl#L194), which in turn calls [_include_debug_entitlements](https://github.com/bazelbuild/rules_apple/blob/421d428779776d51fba48928a3f6adcc59ca56b6/apple/internal/entitlements_support.bzl#L80), and skips macOS entirely.
The comment in `_include_debug_entitlements` clearly says that it is not used in macOS but does not indicate why. There is one concrete use case for it: Instruments profiling. Without the `get-task-allow` entitlement, you get binaries that throw mysterious "Failed to gain Authorization" (or occasionally the even weirder "Required kernel recording resources are in use by another document.") errors.
- [StackOverflow](https://stackoverflow.com/questions/77266659/failed-to-gain-authorization-when-using-instruments)
- [Apple Developer Forum workaround](https://developer.apple.com/forums/thread/681687?answerId=677562022)
- [Detailed blog post on the workaround](https://cocoaphony.micro.blog/2022/10/29/solving-required-kernel.html)
I have confirmed that the workaround works with both `macos_command_line_application` and even `cc_binary`.
Contributor guide
Research direction
Start with doc/common_info.md and apple/internal/entitlements_support.bzl, then trace _process_entitlements and _include_debug_entitlements through the macOS rules in apple/internal/macos_rules.bzl. Check how macos_command_line_application and cc_binary differ from the listed rules, and verify the intended Instruments use case. Done means the supported macOS targets can obtain the debugging entitlement without the documented authorization failures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos
- Domain
- build-system, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100