libiosexec does not work

[asdfugil]

libiosexec - an execve shim to allow executing shell scripts on ios
libiosexec does not work here - it is almost like it isn't there
iOS version: 14.3 with RELEASE kernel - so it definitely works on a real device (can also be reproduced with research kernels though)
In fact this could also be reproduced on an iOS 15.3.1 arm64eCustomerRamDisk with research kernels

bootstrap tarball
To reproduce
From a bash linked with libiosexec (/bin/bash will do), execute /usr/bin/apt-key (or any other script)

shell output:
bash: /usr/bin/apt-key: /bin/sh: bad interpreter: No such file or directory

dmesg output
[ 286.963467]: System Policy: bash(231) deny(1) process-exec-interpreter /usr/bin/dash
for some reason the shebang exec ended up passed to the kernel, even with libiosexec.

Note: I am not asking for a shebang exec kernel patch here - libiosexec is supposed to work around that. There is something else that prevent it from working. (although a shebang exec kernel patch will still fix my apparent issue)

boot command:

${HOME}/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,trustcache-filename=038-83075-083.dmg.trustcache.out,ticket-filename=root_ticket.der \
-kernel kernelcache.research.iphone12b \
-dtb DeviceTree.n104ap.im4p \
-append "-v launchd_missing_exec_no_panic=1 serial=3 keepsyms=1 launchd_unsecure_cache=1" \
-initrd '038-83075-083.dmg.out' \
-cpu max -smp 4 \
-m 2G -serial mon:stdio \
-drive file=nvme.1,format=raw,if=none,id=drive.1 \
-device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvram,if=none,format=raw,id=nvram \
-device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.2,format=raw,if=none,id=drive.2 \
-device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.3,format=raw,if=none,id=drive.3 \
-device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.4,format=raw,if=none,id=drive.4 \
-device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.6,format=raw,if=none,id=drive.6 \
-device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.7,format=raw,if=none,id=drive.7 \
-device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 \
-monitor telnet:127.0.0.1:1235,server,nowait

[TrungNguyen1909]

Can you try installing libiosexec1?
With that package files extracted to the root directory, I don't encounter any problem with running apt-key.

[asdfugil]

It's definitely executing libiosexec calls.. but

localhost:/ root# ls /usr/lib/libiosexec.1.dylib  
^[[A/usr/lib/libiosexec.1.dylib
localhost:/ root# grep -c ie_execv /bin/bash    
2
localhost:/ root# head -n 1 /usr/bin/apt-key 
#!/bin/sh
localhost:/ root# /usr/bin/apt-key          
bash: /usr/bin/apt-key: /bin/sh: bad interpreter: No such file or directory
localhost:/ root# dmesg | grep exec-in
[  199.680003]: System Policy: bash(205) deny(1) process-exec-interpreter /usr/bin/dash
localhost:/ root# 
localhost:/ root# sw_vers
ProductName:    iPhone OS
ProductVersion: 14.3
BuildVersion:   18C66

and libiosexec itself being bugged is out of question considering that Procursus does work on real iPhone 11 iOS 14.3...

[asdfugil]

actually I still have this issue where libiosexec is silently ignored (?) I never solved it