svc · unix #169
csops
Reads or modifies code-signing state for the calling or target process.
Prototype
int csops(pid_t pid, uint32_t ops, user_addr_t useraddr, user_size_t usersize);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| pid | pid_t | - | |
| ops | uint32_t | - | |
| useraddr | user_addr_t | - | |
| usersize | user_size_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 169 |
| xnu-1699.24.8 | macOS 10.7 Lion | 169 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 169 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 169 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 169 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 169 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 169 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 169 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 169 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 169 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 169 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 169 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 169 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 169 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 169 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 169 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 169 |
| xnu-10002.41.9 | — | 169 |
| xnu-10002.61.3 | — | 169 |
| xnu-10002.81.5 | — | 169 |
| xnu-10063.101.15 | — | 169 |
| xnu-10063.121.3 | — | 169 |
| xnu-10063.141.1 | — | 169 |
| xnu-11215.41.3 | — | 169 |
| xnu-11215.61.5 | — | 169 |
| xnu-11215.81.4 | — | 169 |
| xnu-11417.121.6 | — | 169 |
| xnu-11417.140.69 | — | 169 |
| xnu-12377.101.15 | — | 169 |
| xnu-12377.41.6 | — | 169 |
| xnu-12377.61.12 | — | 169 |
| xnu-12377.81.4 | — | 169 |
| xnu-1486.2.11 | — | 169 |
| xnu-1504.15.3 | — | 169 |
| xnu-1504.3.12 | — | 169 |
| xnu-1504.7.4 | — | 169 |
| xnu-1504.9.17 | — | 169 |
| xnu-1504.9.26 | — | 169 |
| xnu-1504.9.37 | — | 169 |
| xnu-1699.22.73 | — | 169 |
| xnu-1699.22.81 | — | 169 |
| xnu-1699.24.23 | — | 169 |
| xnu-1699.26.8 | — | 169 |
| xnu-1699.32.7 | — | 169 |
| xnu-2050.22.13 | — | 169 |
| xnu-2050.24.15 | — | 169 |
| xnu-2050.48.11 | — | 169 |
| xnu-2050.7.9 | — | 169 |
| xnu-2050.9.2 | — | 169 |
| xnu-2422.1.72 | — | 169 |
| xnu-2422.100.13 | — | 169 |
| xnu-2422.110.17 | — | 169 |
| xnu-2422.90.20 | — | 169 |
| xnu-2782.1.97 | — | 169 |
| xnu-2782.10.72 | — | 169 |
| xnu-2782.20.48 | — | 169 |
| xnu-2782.30.5 | — | 169 |
| xnu-3247.10.11 | — | 169 |
| xnu-3248.20.55 | — | 169 |
| xnu-3248.30.4 | — | 169 |
| xnu-3248.40.184 | — | 169 |
| xnu-3248.50.21 | — | 169 |
| xnu-3248.60.10 | — | 169 |
| xnu-3789.21.4 | — | 169 |
| xnu-3789.31.2 | — | 169 |
| xnu-3789.41.3 | — | 169 |
| xnu-3789.51.2 | — | 169 |
| xnu-3789.60.24 | — | 169 |
| xnu-3789.70.16 | — | 169 |
| xnu-4570.20.62 | — | 169 |
| xnu-4570.31.3 | — | 169 |
| xnu-4570.41.2 | — | 169 |
| xnu-4570.51.1 | — | 169 |
| xnu-4570.61.1 | — | 169 |
| xnu-4570.71.2 | — | 169 |
| xnu-4903.231.4 | — | 169 |
| xnu-4903.241.1 | — | 169 |
| xnu-4903.270.47 | — | 169 |
| xnu-6153.101.6 | — | 169 |
| xnu-6153.121.1 | — | 169 |
| xnu-6153.141.1 | — | 169 |
| xnu-6153.41.3 | — | 169 |
| xnu-6153.61.1 | — | 169 |
| xnu-6153.81.5 | — | 169 |
| xnu-7195.101.1 | — | 169 |
| xnu-7195.121.3 | — | 169 |
| xnu-7195.141.2 | — | 169 |
| xnu-7195.60.75 | — | 169 |
| xnu-7195.81.3 | — | 169 |
| xnu-8019.61.5 | — | 169 |
| xnu-8019.80.24 | — | 169 |
| xnu-8020.101.4 | — | 169 |
| xnu-8020.121.3 | — | 169 |
| xnu-8020.140.41 | — | 169 |
| xnu-8792.61.2 | — | 169 |
| xnu-8792.81.2 | — | 169 |
| xnu-8796.101.5 | — | 169 |
| xnu-8796.121.2 | — | 169 |
| xnu-8796.141.3 | — | 169 |
Examples
C — read cs_flags for a target PID
#include <sys/codesign.h>
uint32_t flags = 0;
if (csops(target_pid, CS_OPS_STATUS, &flags, sizeof(flags)) == 0) {
bool platform = (flags & CS_PLATFORM_BINARY) != 0;
}Notes
csops(pid, op, buf, len) is the kernel surface behind every code-signing query on macOS: CS_OPS_STATUS for the cs_flags bitmap, CS_OPS_CDHASH for the binary's hash, CS_OPS_TEAMID for the developer team, CS_OPS_ENTITLEMENTS_BLOB for the signed entitlements blob, plus mutating ops like CS_OPS_MARKINVALID. Querying another process generally requires the same authority needed to inspect that task; mutating ops are gated by AMFI and the platform-binary check.
Detection
Massively legitimate (every codesign(1), every Gatekeeper check, every XPC connection's audit-token validation), so volume alone is uninformative. Alert on CS_OPS_MARKINVALID, CS_OPS_CLEARINSTALLER, CS_OPS_CLEARPLATFORM and any mutator from non-system PIDs. DTrace probe fbt::csops:entry plus arg1 yields the operation code.