Sandboxing and "helper apps"

  • In the past you could include a full UNIX application inside a Mac application bundle. For example, in the directory

    MyApp.app/Contents/MacOS

    could be the Cocoa executable "MyApp" and the UNIX executable "my_helper_app".

    In addition to running this helper app from the Cocoa app, this UNIX app could be launched by the command line from a Terminal application

    $ /Applications/MyApp.app/Contents/MacOS/my_helper_app -i /Users/Todd/some_file

    or via a launchd configuration to be run in the background when I log in.

    Is this functionality no longer allowed with Sandboxing?

    Thanks,

    Todd
  • On Wed, May 30, 2012 at 3:28 AM, Todd Heberlein <todd_heberlein...> wrote:
    >  In the past you could include a full UNIX application inside a Mac application bundle. For example, in the directory
    >
    >        MyApp.app/Contents/MacOS
    >
    > could be the Cocoa executable "MyApp" and the UNIX executable "my_helper_app".
    >
    > In addition to running this helper app from the Cocoa app, this UNIX app could be launched by the command line from a Terminal application
    >
    >        $ /Applications/MyApp.app/Contents/MacOS/my_helper_app -i /Users/Todd/some_file
    >
    > or via a launchd configuration to be run in the background when I log in.
    >
    >
    > Is this functionality no longer allowed with Sandboxing?

    It's allowed. IIRC, when the helper app is launched from the main
    application, it inherits the entitlements/restrictions of its parent.
  • On May 30, 2012, at 4:53 AM, Stephane Sudre wrote:

    > It's allowed. IIRC, when the helper app is launched from the main
    > application, it inherits the entitlements/restrictions of its parent.

    I thought (and I'm barely getting up to speed on this) if the program was launched as an NSTask, it would inherit the entitlements & container of the parent. If it was launched as an XPC service it would have its own entitlements and container.

    But… if the program is launched from a Terminal window or by launchd (e.g., scheduled to run at midnight), what then?  Does it run like a normal UNIX program with no sandboxing?  What if this UNIX helper app is copied to a different directory?  Does Apple forbid a program from MAS that can be launched this way or if the developer induces its users to run it this way?

    Todd
  • On Wed, May 30, 2012 at 4:20 PM, Todd Heberlein <todd_heberlein...> wrote:
    >
    > On May 30, 2012, at 4:53 AM, Stephane Sudre wrote:
    >
    >> It's allowed. IIRC, when the helper app is launched from the main
    >> application, it inherits the entitlements/restrictions of its parent.
    >
    > I thought (and I'm barely getting up to speed on this) if the program was launched as an NSTask, it would inherit the entitlements & container of the parent. If it was launched as an XPC service it would have its own entitlements and container.
    >
    > But… if the program is launched from a Terminal window or by launchd (e.g., scheduled to run at midnight), what then?  Does it run like a normal UNIX program with no sandboxing?  What if this UNIX helper app is copied to a different directory?  Does Apple forbid a program from MAS that can be launched this way or if the developer induces its users to run it this way?

    I would believe this is the same case as for code-signing. Every
    executable must define its entitlements.
previous month may 2012 next month
MTWTFSS
  1 2 3 4 5 6
7 8 9 10 11 12 13
14 15 16 17 18 19 20
21 22 23 24 25 26 27
28 29 30 31      
Go to today