{{ message }}
Repository navigation
logarchive: TCC authorization cache and location manager state statedump artifacts - #2518
Merged
abrignoni merged 5 commits intoOct 20, 2026
Merged
Conversation
…ump artifacts Four artifacts over the logarchive_artifacts table. Statedump records have no subsystem or category and the table does not keep the event type, so they are collected by the first line of the message, as well as filtered in the dependent artifacts: - logarchive TCC authorization cache dumps: one row per cached entry of each 'title: TCC Authorization Cache' dump, with the service, the two object addresses, the auth right, reason, version and any flags text as logged and the process that wrote the dump. Empty dumps give no row; an unreadable body gives one row with the text as logged. - logarchive TCC authorization cache summary: the same entries collapsed, with the first and last dump holding each and the number of dumps. A labelled view, not a change log. - logarchive location manager state dumps: one row per 'title: CLLocationManagerStateTracker' dump with sixteen logged keys as columns and the remaining keys, and any line that is not a key and value, in Other Fields. - logarchive location manager state summary: distinct content per process and PID, with first and last dump and the number of dumps. Values are copied as logged and no meaning is assigned. The dumps do not name the application they describe; the only attribution is the process that wrote them. Tested through the real ileapp.py two-stage chain on a synthetic 'log show' export (every branch, shapes marked INVENTED SHAPE, decoys, a marker-removal check that fails the tests). The new case runs the logarchive producer over the export; the artifacts declare no paths so the case harness cannot supply their input. make_test_data.py treats `paths: None` as no patterns (same change as on add-camera-mic-capture-sessions). No data from a real extraction is committed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
testdata.logarchive.json: union of the case keys (case_synthetic_capture from main, case_synthetic_statedump from this branch). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…lines with POSIX paths - testdata.logarchive.json: both cases (case_synthetic_capture, case_synthetic_statedump) regenerated with make_test_data.py so every artifact of the module is listed, including the camera/microphone and the TCC and location statedump artifacts. Descriptions, maker and the case zips are unchanged. - The statedump baseline was recorded on Windows, so input_zip_path held backslashes. Re-recorded (TZ=UTC); headers and rows are identical to the superseded snapshot apart from the path separator, which is now POSIX. The capture baseline's input_zip_path gets the same separator fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Row counts from ai16_ios26_sysdiag (iOS 26.5.2) and hc_ios26_sysdiag (iOS 26.6), read from tracev3 data. The notes now give the values seen there, the share of rows that are entitled AddressBook entries written by system processes, how the dumps sit beside TCC.db, and the location dumps' fixed key set. "Tested" becomes "read" for the privately read logs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The TCC address columns hold only the hex address taken from each description, so they are now Credential Object Address and Authorization Object Address. Dump-count sentences give the measured range instead of "many", the per-manager premise for location dumps is stated as not established, and process counts say they count image paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four artifacts over the logarchive_artifacts table. Statedump records have no
subsystem or category and the table does not keep the event type, so they are
collected by the first line of the message, as well as filtered in the
dependent artifacts:
'title: TCC Authorization Cache' dump, with the service, the two object
addresses, the auth right, reason, version and any flags text as logged and the
process that wrote the dump. Empty dumps give no row; an unreadable body gives
one row with the text as logged.
first and last dump holding each and the number of dumps. A labelled view, not
a change log.
CLLocationManagerStateTracker' dump with sixteen logged keys as columns and the
remaining keys, and any line that is not a key and value, in Other Fields.
PID, with first and last dump and the number of dumps.
Values are copied as logged and no meaning is assigned. The dumps do not name the
application they describe; the only attribution is the process that wrote them.
Tested through the real ileapp.py two-stage chain on a synthetic 'log show'
export (each parser fallback, invented shapes marked in the generator, decoys,
and a test that fails if a collection marker is removed). The new case runs the
logarchive producer over the export; the artifacts declare no paths so the case
harness cannot supply their input. No data from a real extraction is committed.
Also run on two corpus sysdiagnoses, read from tracev3 data; counts are in
sample_data:
location state rows. Every body read and every authorization record matched.
state rows.
Most TCC rows are entitled AddressBook entries written by system processes.
Both sysdiagnoses also hold TCC.db, which names the client; the dumps add the
writing process and the dump time. The two address columns are now named
Credential Object Address and Authorization Object Address.
Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com