App Sandbox

App Sandbox is a macOS access control technology designed to contain damage to the system and user data if an app becomes compromised.

App Sandbox Documentation

Posts under App Sandbox tag

103 results found
Post marked as unsolved
38 Views

NSSavePanel / NSOpenPanel

The NSSavePanel in a sandboxed app is limited to one file when I enable the User Selected files sandbox entitlements. The same is true for the NSSavePanel. Now the problem is, I am writing an app for an IC Device Programmer (TL866II). Some of the IC's have 3 sections of memory type, a Flash and EEProm and Fuses, so I am supposed to read all three parts at once and then save them to disk. The problem is still that the files have to be separated into a Flash.bin file, an EEProm.bin file and a Fusebit.bin file. To do this I have to open the NSSavePanel 3 times to save each part of the IC data. I have modified a NSOpenPanel to save all 3 parts, but the OK button is only selectable when I have selected a file. I cannot save a new file without selecting a file. Does anyone have an idea to solve this problem. I tried Bookmark Security but it is the same problem, only one file is allowed. Programming electronics software is very hard with sandbox and without sandbox, Apple rejects the software.
Asked
by macsven.
Last updated .
Post marked as unsolved
65 Views

After adding sandbox entitlement to exec file, can't run exec through app

Before adding the sandbox entitlement to the exec file, the app ran perfectly. After adding the entitlement properties below, I get an error: my.sh: line 2: 41382 Killed: 9 $1 $2 "$3" $4 "$5" Entitlement properties added: keycom.apple.security.app-sandbox/key true/ keycom.apple.security.inherit/key true/ I'm signing with my Apple Development identity. I tried also by signing with my 3rd Party Mac Developer Application.  Lastly, I am running this exec through a plugin, I don't know if that could be the cause of the error. Please help.
Asked
by saeidg.
Last updated .
Post marked as unsolved
134 Views

Is there a sandbox-safe way to get the color of the new iMac models?

In the heyday of the G3 iMacs, Internet Explorer provided an option to color its UI based on the color of the iMac it was being run on. I believe they accomplished this by looking at the machine's serial number. I would like to provide a similar, though much more subtle, experience for users who open my app on a new iMac. For privacy reasons, I'd rather not be reading the user's serial number if possible. I looked through the macOS SDK bundled in Xcode 12.5 RC, but didn't find any obvious addition that would allow me to get the color. Is there currently any way to retrieve this information? Thanks in advance.
Asked
by Buckley.
Last updated .
Post marked as unsolved
69 Views

Sandbox allows or denies user-selected files to be saved

Two classes in my sandboxed application need to export a NSDictionary as a plist file. On the Capabilities, the Permission/Access setting is read/Write for User selected files. I use XCode 10.11.1 on Mojave, and build for ≥10.12. From several classes that need to export files, two are very similar and manage NSDictionary. For those two, when the user prompts for save, I open a NSSavePanel to choose the destination filename and directory. I use exactly the same code for my two classes: NSSavePanel *panel = [NSSavePanel savePanel]; [panel setNameFieldStringValue:newFilename]; panel.extensionHidden = TRUE; [panel beginWithCompletionHandler:^(NSInteger result) { if (result == NSFileHandlingPanelOKButton) { NSURL *saveURL = [panel URL]; NSString *savePath = [saveURL path]; if (![[savePath pathExtension] isEqual:@"plist"]){ savePath = [savePath stringByDeletingPathExtension]; savePath = [savePath stringByAppendingString:@".plist"]; } [exportDic writeToFile:savePath atomically:YES]; } }]; What is strange is that saving this ways always works for one class that use this code, whereas it doesn't succeed for the second class, except one non-reproductible time! I got no message on the debugger console, but I can see one in the Console application: Sandbox: MyApp (xxxx) deny(1) file-write-create my_file_path.plist I verified everything, reset the sandbox setting, clean build folder, quit/relaunched Xcode, and even rebooted the computer several times. Any idea? Thanks
Asked
Last updated .
Post marked as unsolved
95 Views

How do I know which APP is using my custom keyboard

Following guidelines Custom Keyboard - https://developer.apple.com/design/human-interface-guidelines/ios/extensions/custom-keyboards/#custom-input-views, I create my custom keyboard. But I don’t know which app is using it. Can anyone tell me how can I know running app? Thanks!
Asked
Last updated .
Post marked as unsolved
105 Views

What is the entitlement needed to use the system progress bar for files?

I'm trying to implement this gist (https://gist.github.com/mminer/3c0fbece956f3a5fa795563fafb139ae) in my app to replicate the progress bar that shows up in your Downloads when you download something from Safari or Chrome. The progress bar looks like this (i.imgur.com/R3U1M7Y.png) For now, I've just put the test in the init in App.swift: init() {     let path = ProcessInfo.processInfo.environment["HOME"]! + "/Downloads/a.txt"     FileManager.default.createFile(atPath: path, contents: nil, attributes: [:])     let url = URL(fileURLWithPath: path)     let progress = Progress(parent: nil, userInfo: [          ProgressUserInfoKey.fileOperationKindKey: Progress.FileOperationKind.downloading,         ProgressUserInfoKey.fileURLKey: url,     ])     progress.kind = .file     progress.isPausable = false     progress.isCancellable = false     progress.totalUnitCount = 5     progress.publish()     while (progress.completedUnitCount progress.totalUnitCount) {       sleep(1)       progress.completedUnitCount += 1       NSLog("progress %d", progress.completedUnitCount)     }     progress.unpublish() } I have the com.apple.security.files.downloads.read-write entitlement to write to Downloads. And, it works! But only when App Sandbox is off. When App Sandbox is on, the file writes to Downloads, but the progress bar doesn't show. Any ideas what entitlement is needed to get this to work?
Asked
Last updated .
Post marked as unsolved
105 Views

Connecting a sandboxed app extension to an XPC service outside of the sandbox

I have a Safari App extension that has to communicate with another app that is outside the sandbox. I wanted to place an XPC service in between the two. Would it be possible to talk to an XPC service outside the sandbox with the use of temporary entitlements ? or are apple events the only way to go? If XPC service is possible, would it have to be an XPC exposed through a daemon process or can it be bundled with the non sandboxed app ?
Asked
Last updated .
Post marked as unsolved
74 Views

Can a binary outside of the sandbox be run from an App Extension?

I tried running a python binary that resides in the NSApplicationsScript Directory from a Safari app extension but it does not seem to run it, given proper entitlements. Is this a sandbox restriction for App extension ?
Asked
Last updated .
Post marked as unsolved
81 Views

Using An old iMac for App Development

First, newbie here, so be kind. Second, almost eligible for SS so be kinder;-) I have an old iMac 27-inch (late-2009) with High Sierra 10.13.6. I can load Visual Studio on my system finally, but still cannot build apps because the hardware appears too old for Xcode ... 12.5 Beta 3. Any solutions without buying new hardware ... or new hardware is the way to go? IF new hardware is the ONLY option what is the least expensive route (I WANT the Mac Pro, but $6k entry point is very restrictive for "playing around")
Asked
by TA4TC.
Last updated .
Post marked as unsolved
156 Views

Error when running a binary from containing app

I am running a Safari Web extension and looking to launch a shell script from the containing app. Error in process Error Domain=NSCocoaErrorDomain Code=4 "The file “test.command” doesn’t exist." I get the above error when I try to access the binary. I use NSOpenPanel to allow the user to give permission to access the file system. The program works perfectly without the sandbox and so that ensures there is no file path error. I have the following entitlements: com.apple.security.scripting-targets com.apple.security.files.user-selected.executable com.apple.security.files.user-selected.read-write  let task = Process()     task.launchPath = "/Users/test/test.command"      let openPanel = NSOpenPanel()   openPanel.prompt = "Choose"   openPanel.canChooseFiles = false   openPanel.canChooseDirectories = true        do{       try task.run()     }catch{       os_log(.error,"Error in process")       print(" \(error)")     } What could be the issue ?
Asked
by sabz19.
Last updated .
Post marked as unsolved
52 Views

How to run an executable binary from outside the sandbox?

Is it possible to run a compiled binary from a sandboxed app with proper entitlement and user permission ? I tried giving the following permissions and it still did not run com.apple.security.scripting-targets com.apple.security.files.user-selected.executable com.apple.security.files.user-selected.read-write
Asked
by sabz19.
Last updated .
Post marked as unsolved
163 Views

Not authorised to send Apple Events to Finder from helper bundle

I'm having issues with executing AppleScript from the application helper bundle, which is contained in my main application bundle. I have a simple helper application bundle which only loads my script located in helpers' bundle Resources using NSAppleScript API and executes it. Script is really simple, it basically just deletes some other application bundle. I've tested the script as standalone and everything works fine. When I run the helper bundle everything falls apart. I'm getting -1743 error (Not authorised to send Apple Events to Finder). My helper bundle is not sandboxed, has enabled apple events in the entitlements file and I've added NSAppleEventsUsageDescription key to the plist. If I run this from Xcode it works, same if I execute the binary contained in the bundle from command line. Any ideas what might be causing the issue?
Asked
by mezox.
Last updated .
Post marked as unsolved
274 Views

Requesting temporary entitlement exceptions

Hi everyone! My macOS app was rejected. The reason: The following temporary entitlement exceptions requested for this app are not appropriate and will not be granted:com.apple.security.temporary-exception.apple-events com.apple.terminalcom.apple.security.temporary-exception.apple-events com.apple.finderWe understand this may prevent the app from being approved for the Mac App Store. We encourage you to investigate other ways of implementing the desired functionality. My app should run shell command in the Terminal, reveal a folder in the Finder and open a file in the TextEdit. I achieved with functionality with executing NSAppleScript. I have already added App Sandbox entitlements: YES entitlement com.apple.security.files.user-selected.read-only: 1 entitlements com.apple.security.temporary-exception.apple-events (mentioned above) NSAppleEventsUsageDescription But I have no idea how should I request these entitlements. I searched for any documentation but didn't find anything. What should I do to pass a review? Or is there any other way to achieve desired functionality? Thx
Asked
by andrey_v.
Last updated .
Post marked as unsolved
406 Views

My .app won't launch on an M1 mac

Hi, I've built everything natively for arm64, the M1 doesnt have Rosetta 2 installed. The app runs fine when started from the terminal. I am packaging the .app exactly the same way as for x86_64 but it refuses to launch on an M1 mac. I see "You do not have permission to open the application 'APPNAME'" when trying to open the app. I've tried when both codesigned and not codesigned (both work on x86 dev machine). In Console.app I see: LAUNCH: Runningboard launch of com.mydomain.myapp private returned RBSRequestErrorFailed, error Error Domain=RBSRequestErrorDomain Code=5 "Launch failed." UserInfo={NSLocalizedFailureReason=Launch failed., NSUnderlyingError=0x600007803450 {Error Domain=NSPOSIXErrorDomain Code=111 "Unknown error: 111" UserInfo={NSLocalizedDescription=Launchd job spawn failed with error: 111}}}, so returning -10826 The app launches using shell scripts, I've tried to modify the plist to launch the executable directly to see whether it was the issue, but it didnt change anything. The way its starting makes me think it doesnt even try to launch the executable and that its failing right away when looking at something in the package, but I have no idea what it could be. I've been at this for hours, any help would be appreciated. Cheers
Asked
by thexash.
Last updated .