dlopen in enterprise distribution , dylib: file system sandbox blocked mmap()

We develop a system that can open frameworks which are located in document path in iPads by use "dlopen method" (iPadOS v15)

It works fine when we build the app in device or use "development method" to archive the APP.

But When we try to release our enterprise by use "in-house method" to archive the APP.

Then the error message shows "dylib: file system sandbox blocked mmap()" when our enterprise APP try to open the framework in the APP`s document sandbox.

Why it is able to use this dlopen method under "development method" but is not able to work in "in-house method" ?

Is there any restriction of use "dlopen" by distribution release of enterprise program?

Replies

It is possible to use dlopen on i[Pad]OS but there are some serious limitations. Specifically, you can only use it to load a library that’s part of the OS or embedded within your app (and correctly signed). What library are you trying to load? And if it’s a library within your app, where is it located within the app bundle?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • It was located in Document folder.

Add a Comment

Thank you for reply ! It's a customized framework . not an OS library . And this customized framework was well signed but did not embed in the main bundle . It was located in "Data Container" (Document folder) .

And this customized framework was well signed but did not embed in the main bundle. It was located in "Data Container" (Document folder).

That is most definitely not supported. iOS apps can only load code that’s part of the OS or bundled within the app. I suspect that you managed to get this working during development because we loosen some restrictions in that case, but it’s definitely not going to work in production.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

But I need this need. How do I do it

back soon

But I need this need. How do I do it

What specifically?

If you want to load and run native code that’s not embedded in your app then you are out of luck. That functionality simply isn’t supported on iOS and its child platforms. And this isn’t simple a question of it not being allowed by App Review. This restriction is absolutely fundamental to the platform security model.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I need to download the signed framework uploaded by myself, because I need to use it to communicate with Bluetooth devices. Each function is different, so I must download and use it

I see other APP is done, like https://apps.apple.com/cn/app/maxiap-ap200/id1338602548?l=en

I need to download the signed framework uploaded by myself

Again, this simply isn’t possible with the iOS security architecture as it currently stands.

I can’t comment on other developers apps, but I suspect that you’ve misunderstood how they’ve achieved their functionality.

Keep in mind that I’m talking about native code. You can certainly download and run non-native code. For example, you could implement this functionality in JavaScript and then run the code using JavaScriptCore, using its bridging functionality to allow the JavaScript to talk to Bluetooth.

WARNING The previous paragraph is about what’s technically possible. App Review has the final say on what is or isn’t allowed on the App Store. I don’t work for App Review and can’t make definitive statements on their behalf. As always, review the App Store Review Guidelines before you start coding.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

he download this,How do I open it?

he download this

Who do you mean by “he” in this sentence?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Can I sign, verify, review the dynamic library and then put it on the server to download, but can't open it?

'he' mean this app https://apps.apple.com/cn/app/thinkdiag/id1483420979,He was able to open dynamic libraries in the sandbox

Can I sign, verify, review the dynamic library and then put it on the server to download but can't open it?

“sign” — Kinda [1].

“verify” — I’m not sure what that means. My best guess is that you’re talking about the Validate App button in the Xcode organiser. If so, that only works with apps, not frameworks.

“review” — With App Review? If so, the answer is “No.” App Review only allows you to submit apps.

“put it on the server” — Sure.

“download” — Sure.

“open” — No. As I’ve mentioned before, iOS’s security model prevents you from running code that you download in this way.

this app … was able to open dynamic libraries in the sandbox

I very much doubt that. If that were the case, it’d be a massive security vulnerability in iOS.

I suspect that you’ve misunderstood how that app works. However, I’m not able to reverse engineer other developer’s apps on your behalf. If you want to know how it does what it does, you should feel free to reach out to the author.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] You can sign an iOS framework as a standalone code item and, if this were macOS, that’d be sufficient. However, the way that iOS apps reference their frameworks is somewhat different from that on macOS so the question as to whether this is signed correctly is a matter of interpretation.

This is what we need to do in our project. The dynamic library we downloaded is for controlling Bluetooth devices to diagnose faults of vehicle devices. How should I achieve this?Can you help me? Or can I package the executable file into the program and download the resource into the sandbox, because this part of the resource is very big?