Running an executable with NSTask - sandbox issues?

Question

I have a Mac OSX application that launches an executable file located in / Contents / Resources. The app is not intended to be released on the App Store, so I don't have a sandbox.

Launch Code:

toolPath = [[[NSBundle mainBundle] pathForResource:@"myexecutable" ofType:@""] copy]; task = [[NSTask alloc] init]; [task setLaunchPath: toolPath]; pipe = [[NSPipe alloc] init]; [task setArguments:[NSArray arrayWithObjects:@"-someArg", someVariable, nil]]; file = [[NSFileHandle alloc] initWithFileDescriptor:[pipe fileHandleForReading].fileDescriptor]; [task setStandardOutput: stderrPipe]; [task launch]; 

The fact is that everything works fine when working in Xcode. It also works great when exporting an application to the desktop and running it.

However, if I archive the application, upload it to the web server, and then upload it to the same computer (or delete it on another Mac), the task no longer starts! I do not see errors in the system console or anything else.

I examined some of these issues and found that OSX will mark the new application as a “quarantined” special permission right. Therefore, I examined the difference between the downloaded application and the exported application:

Executable file permissions after exporting my application from Xcode:

 -rwxr-xr-x 1 Username staff 65724 21 Jul 16:31 executableName 

At this point, the application works fine, and the executable is launched from a button inside the application.

And after zipping the application downloaded to the server, downloaded, unzipped and opened the application and accepting the dialog "This application was downloaded from the Internet":

 -rwxr-xr-x 1 Username staff 65724 21 Jul 16:31 executableName com.apple.quarantine 26 

At this moment, nothing happens when I click a button in my application.

If I then run xattr -rd com.apple.quarantine for the entire application, the quarantine notification will be deleted:

 -rwxr-xr-x 1 Username staff 65724 21 Jul 16:31 executableName 

but the executable does not start yet!

At this point, I now have the following permissions for my desktop application:

/ Contents / MacOS:

 -rwxr-xr-x 1 Username staff 407728 21 Jul 16:31 appName 

/ Contents / Resources:

 -rwxr-xr-x 1 Username staff 65724 21 Jul 16:31 executableName 

And in the downloaded application that I used xattr -rd:

/ Contents / MacOS:

 -rwxr-xr-x 1 Username staff 407728 21 Jul 16:31 appName 

/ Contents / Resources:

 -rwxr-xr-x 1 Username staff 65724 21 Jul 16:31 executableName 

The first application works fine, and the second never launches an executable file. What the hell is going on? This is the same application, on the same computer, with the same permissions, but the downloaded one just does not work.

This problem appears in all versions of OSX on different computers.

Answer 1

Adding com.apple.security.inherit privileges to the helper application resolved this issue for me.

My helper application used to crash with Could not set sandbox profile data: Operation not permitted (1) when I tried to launch it using NSTask.

from the Apple documentation:

If your application uses a child process created using the posix_spawn function or the NSTask class, you can configure the child process to inherit its parent's sandbox. However, using a child process does not provide the security provided by the XPC service.

To enable sandbox inheritance, the child target must use exactly two sandbox access rights keys: com.apple.security.app-sandbox and com.apple.security.inherit . If you specify any other right to use Sandbox, the system interrupts the child process. However, you can transfer other features to the child process through iCloud and notifications. The main application in an Xcode project should never have a YES value of inheritance.

I hope this solution helps.

Answer 2

I finally found out what caused this problem, it happened while trying to run an executable file with NSTask, which writes files. Oddly enough, this works great in some cases, as mentioned in the original post. But to make it work on other computers, I decided to use STPrivilegedTask , which solved the problem.