From 6a2a6789cdb7458dc169d568138b69c10b259211 Mon Sep 17 00:00:00 2001
From: Renlord Yang <renlord@apple.com>
Date: Tue, 29 Sep 2026 15:48:47 +0800
Subject: [PATCH 1/2] Fix `container system status` false negative under a
 Seatbelt sandbox.

`system status` gated its output on a launchd registration probe that shelled out
to the legacy `launchctl list`. launchd applies an unconditional anti-sandbox
check to the entire legacy domain-IPC family, so inside any Seatbelt sandbox
`launchctl list` exits 1 with empty stdout *and* stderr -- indistinguishable from
"the label is not registered", and not fixable by any sandbox profile. `system
status` therefore reported `unregistered` and exited 1 while the apiserver was
running and answering XPC.

Probe with `launchctl print <domain>/<label>` instead, which launchd does allow a
sandboxed process, and key off exit codes: 0 means registered, 113 (ENOSERVICE)
means not registered, and anything else is an error rather than being
mistranslated into a negative. The probe is advisory in `system status`, so an
indeterminate answer falls through to the XPC health check, whose success is
authoritative.

Signed-off-by: Renlord Yang <renlord@apple.com>
---
 .../System/SystemStatus.swift                 |  2 +-
 Sources/ContainerPlugin/ServiceManager.swift  | 44 +++++++++++++--
 .../ServiceManagerTests.swift                 | 54 +++++++++++++++++++
 3 files changed, 96 insertions(+), 4 deletions(-)
 create mode 100644 Tests/ContainerPluginTests/ServiceManagerTests.swift

diff --git a/Sources/ContainerCommands/System/SystemStatus.swift b/Sources/ContainerCommands/System/SystemStatus.swift
index ff6349579..79143ddff 100644
--- a/Sources/ContainerCommands/System/SystemStatus.swift
+++ b/Sources/ContainerCommands/System/SystemStatus.swift
@@ -42,7 +42,7 @@ extension Application {
         public init() {}
 
         public func run() async throws {
-            let isRegistered = try ServiceManager.isRegistered(fullServiceLabel: "\(prefix)apiserver")
+            let isRegistered = (try? ServiceManager.isRegistered(serviceLabel: "\(prefix)apiserver")) ?? true
             if !isRegistered {
                 try Output.render(payload: StatusPayload(status: "unregistered"), format: format) {
                     "apiserver is not running and not registered with launchd"
diff --git a/Sources/ContainerPlugin/ServiceManager.swift b/Sources/ContainerPlugin/ServiceManager.swift
index 4d2c36246..d05f2f510 100644
--- a/Sources/ContainerPlugin/ServiceManager.swift
+++ b/Sources/ContainerPlugin/ServiceManager.swift
@@ -18,6 +18,10 @@ import ContainerizationError
 import Foundation
 
 public struct ServiceManager {
+    enum LaunchctlStatus {
+        static let noSuchService: Int32 = 113
+    }
+
     private static func runLaunchctlCommand(args: [String]) throws -> Int32 {
         let launchctl = Foundation.Process()
         launchctl.executableURL = URL(fileURLWithPath: "/bin/launchctl")
@@ -93,9 +97,43 @@ public struct ServiceManager {
     }
 
     /// Check if a service has been registered or not.
-    public static func isRegistered(fullServiceLabel label: String) throws -> Bool {
-        let exitStatus = try runLaunchctlCommand(args: ["list", label])
-        return exitStatus == 0
+    public static func isRegistered(serviceLabel label: String) throws -> Bool {
+        let domain = try Self.getDomainString()
+        let target = "\(domain)/\(label)"
+        let result = try runLaunchctlPrint(target: target)
+        return try Self.interpretPrintStatus(result.status, target: target, standardError: result.standardError)
+    }
+
+    private static func runLaunchctlPrint(target: String) throws -> (status: Int32, standardError: String) {
+        let launchctl = Foundation.Process()
+        launchctl.executableURL = URL(fileURLWithPath: "/bin/launchctl")
+        launchctl.arguments = ["print", target]
+
+        let stderrPipe = Pipe()
+        launchctl.standardOutput = FileHandle.nullDevice
+        launchctl.standardError = stderrPipe
+
+        try launchctl.run()
+        let errorData = stderrPipe.fileHandleForReading.readDataToEndOfFile()
+        launchctl.waitUntilExit()
+
+        return (launchctl.terminationStatus, String(decoding: errorData, as: UTF8.self))
+    }
+
+    static func interpretPrintStatus(_ status: Int32, target: String = "", standardError: String = "") throws -> Bool {
+        switch status {
+        case 0:
+            return true
+        case LaunchctlStatus.noSuchService:
+            return false
+        default:
+            var message = "command `launchctl print \(target)` failed with status \(status)"
+            let details = standardError.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !details.isEmpty {
+                message += ", message: \(details)"
+            }
+            throw ContainerizationError(.internalError, message: message)
+        }
     }
 
     private static func getLaunchdSessionType() throws -> String {
diff --git a/Tests/ContainerPluginTests/ServiceManagerTests.swift b/Tests/ContainerPluginTests/ServiceManagerTests.swift
new file mode 100644
index 000000000..388802555
--- /dev/null
+++ b/Tests/ContainerPluginTests/ServiceManagerTests.swift
@@ -0,0 +1,54 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the container project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+import Foundation
+import Testing
+
+@testable import ContainerPlugin
+
+struct ServiceManagerTests {
+    @Test
+    func testInterpretPrintStatusSuccessMeansRegistered() throws {
+        #expect(try ServiceManager.interpretPrintStatus(0))
+    }
+
+    @Test
+    func testInterpretPrintStatusNoSuchServiceMeansUnregistered() throws {
+        #expect(try !ServiceManager.interpretPrintStatus(ServiceManager.LaunchctlStatus.noSuchService))
+    }
+
+    @Test
+    func testInterpretPrintStatusUnexpectedStatusThrows() throws {
+        let statuses: [Int32] = [1, 3, 64, 112]
+        for status in statuses {
+            #expect {
+                _ = try ServiceManager.interpretPrintStatus(
+                    status,
+                    target: "gui/501/com.apple.container.apiserver",
+                    standardError: "marker"
+                )
+            } throws: { error in
+                "\(error)".contains("status \(status), message: marker")
+            }
+        }
+    }
+
+    @Test
+    func testIsRegisteredUnknownLabel() throws {
+        let label = "com.apple.container.bogus-\(UUID().uuidString)"
+        #expect(try !ServiceManager.isRegistered(serviceLabel: label))
+    }
+}

From 890a8c9e7f9804c0db9973a7aee35066d424020f Mon Sep 17 00:00:00 2001
From: Renlord Yang <renlord@apple.com>
Date: Mon, 5 Oct 2026 08:02:39 +0800
Subject: [PATCH 2/2] Keep fullServiceLabel for isRegistered

---
 Sources/ContainerCommands/System/SystemStatus.swift  | 3 ++-
 Sources/ContainerPlugin/ServiceManager.swift         | 8 +++-----
 Tests/ContainerPluginTests/ServiceManagerTests.swift | 5 +++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Sources/ContainerCommands/System/SystemStatus.swift b/Sources/ContainerCommands/System/SystemStatus.swift
index 79143ddff..6e83c0bab 100644
--- a/Sources/ContainerCommands/System/SystemStatus.swift
+++ b/Sources/ContainerCommands/System/SystemStatus.swift
@@ -42,7 +42,8 @@ extension Application {
         public init() {}
 
         public func run() async throws {
-            let isRegistered = (try? ServiceManager.isRegistered(serviceLabel: "\(prefix)apiserver")) ?? true
+            let domain = try ServiceManager.getDomainString()
+            let isRegistered = (try? ServiceManager.isRegistered(fullServiceLabel: "\(domain)/\(prefix)apiserver")) ?? true
             if !isRegistered {
                 try Output.render(payload: StatusPayload(status: "unregistered"), format: format) {
                     "apiserver is not running and not registered with launchd"
diff --git a/Sources/ContainerPlugin/ServiceManager.swift b/Sources/ContainerPlugin/ServiceManager.swift
index d05f2f510..8abc16304 100644
--- a/Sources/ContainerPlugin/ServiceManager.swift
+++ b/Sources/ContainerPlugin/ServiceManager.swift
@@ -97,11 +97,9 @@ public struct ServiceManager {
     }
 
     /// Check if a service has been registered or not.
-    public static func isRegistered(serviceLabel label: String) throws -> Bool {
-        let domain = try Self.getDomainString()
-        let target = "\(domain)/\(label)"
-        let result = try runLaunchctlPrint(target: target)
-        return try Self.interpretPrintStatus(result.status, target: target, standardError: result.standardError)
+    public static func isRegistered(fullServiceLabel label: String) throws -> Bool {
+        let result = try runLaunchctlPrint(target: label)
+        return try Self.interpretPrintStatus(result.status, target: label, standardError: result.standardError)
     }
 
     private static func runLaunchctlPrint(target: String) throws -> (status: Int32, standardError: String) {
diff --git a/Tests/ContainerPluginTests/ServiceManagerTests.swift b/Tests/ContainerPluginTests/ServiceManagerTests.swift
index 388802555..890aa9379 100644
--- a/Tests/ContainerPluginTests/ServiceManagerTests.swift
+++ b/Tests/ContainerPluginTests/ServiceManagerTests.swift
@@ -48,7 +48,8 @@ struct ServiceManagerTests {
 
     @Test
     func testIsRegisteredUnknownLabel() throws {
-        let label = "com.apple.container.bogus-\(UUID().uuidString)"
-        #expect(try !ServiceManager.isRegistered(serviceLabel: label))
+        let domain = try ServiceManager.getDomainString()
+        let label = "\(domain)/com.apple.container.bogus-\(UUID().uuidString)"
+        #expect(try !ServiceManager.isRegistered(fullServiceLabel: label))
     }
 }