[lldb] Upstream macOS TCC code

[JDevlieghere]

Summary

Upstream the code for dealing with TCC introduced in macOS Mojave. This will make the debuggee instead of the debugger responsible for the privileges it needs.

[mib]

LGTM!

lldb/source/Host/macosx/objcxx/Host.mm

 //===-- Host.mm -------------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "lldb/Host/Host.h"
+#include "PosixSpawnResponsible.h"
 
 #include <AvailabilityMacros.h>
 #include <TargetConditionals.h>
 
 #if TARGET_OS_OSX
 #define __XPC_PRIVATE_H__
 #include <xpc/xpc.h>
 
static Status LaunchProcessPosixSpawn(const char *exe_path,
   error.SetError(::posix_spawnattr_setflags(&attr, flags), eErrorTypePOSIX);
   if (error.Fail()) {
     LLDB_LOG(log,
              "error: {0}, ::posix_spawnattr_setflags ( &attr, flags={1:x} )",
              error, flags);
     return error;
   }
 
+  bool is_graphical = true;
+
+#if TARGET_OS_OSX
+  SecuritySessionId session_id;
+  SessionAttributeBits session_attributes;
+  OSStatus status =
+      SessionGetInfo(callerSecuritySession, &session_id, &session_attributes);
+  if (status == errSessionSuccess)
+    is_graphical = session_attributes & sessionHasGraphicAccess;
+#endif
+
+  //  When lldb is ran through a graphical session, this makes the debuggee
+  //  process responsible for the TCC prompts. Otherwise, lldb will use the
+  //  launching process privileges.
+  if (is_graphical && launch_info.GetFlags().Test(eLaunchFlagDebug)) {
+    error.SetError(setup_posix_spawn_responsible_flag(&attr), eErrorTypePOSIX);
+    if (error.Fail()) {
+      LLDB_LOG(log, "error: {0}, setup_posix_spawn_responsible_flag(&attr)",
+               error);
+      return error;
+    }
+  }
+
   const char *tmp_argv[2];
   char *const *argv = const_cast<char *const *>(
       launch_info.GetArguments().GetConstArgumentVector());
   Environment::Envp envp = launch_info.GetEnvironment().getEnvp();
   if (argv == NULL) {
     // posix_spawn gets very unhappy if it doesn't have at least the program
     // name in argv[0]. One of the side affects I have noticed is the
     // environment

lldb/source/Host/macosx/objcxx/PosixSpawnResponsible.h

+//===-- PosixSpawnResponsible.h ---------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLDB_HOST_POSIXSPAWNRESPONSIBLE_H
+#define LLDB_HOST_POSIXSPAWNRESPONSIBLE_H
+
+#include <spawn.h>
+
+#if __has_include(<responsibility.h>)
+#include <dispatch/dispatch.h>
+#include <dlfcn.h>
+#include <responsibility.h>
+
+// Older SDKs  have responsibility.h but not this particular function. Let's
+// include the prototype here.
+errno_t responsibility_spawnattrs_setdisclaim(posix_spawnattr_t *attrs,
+                                              bool disclaim);
+
+#endif
+
+static inline int setup_posix_spawn_responsible_flag(posix_spawnattr_t *attr) {
+  if (@available(macOS 10.14, *)) {
+#if __has_include(<responsibility.h>)
+    static __typeof__(responsibility_spawnattrs_setdisclaim)
+        *responsibility_spawnattrs_setdisclaim_ptr;
+    static dispatch_once_t pred;
+    dispatch_once(&pred, ^{
+      responsibility_spawnattrs_setdisclaim_ptr =
+#ifdef __cplusplus
+          reinterpret_cast<__typeof__(&responsibility_spawnattrs_setdisclaim)>
+#endif
+          (dlsym(RTLD_DEFAULT, "responsibility_spawnattrs_setdisclaim"));
+    });
+    if (responsibility_spawnattrs_setdisclaim_ptr)
+      return responsibility_spawnattrs_setdisclaim_ptr(attr, true);
+#endif
+  }
+  return 0;
+}
+
+#endif // LLDB_HOST_POSIXSPAWNRESPONSIBLE_H