“eskimo”

[quote='910242022, denisfromlomazzo, /thread/726936?answerId=910242022#910242022, /profile/denisfromlomazzo'] Are there any hopes in this space? [/quote] My earlier reply drew a distinction between macOS- and iOS-style app groups. I believe there is hope on this front for the latter, and that’s backed up by the fact that kavvver’s bug report (FB17264508) hasn’t been returned as ‘not be be fixed’. However, I can’t make any promises as to the timeline. So, if you need this soon my advice is that you explore other options (and, yeah, I know, none of those options are great )-: Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

You certainly can’t do that from the host app. Virtualization simply doesn’t give you that level of control. To do something like this you’d have to run your own agent [1] within the macOS guest and use macOS facilities: If your agent runs the process, it can start it suspended. For a process it didn’t start, the agent an manage it via Endpoint Security, either system wide or via within a process hierarchy using es_new_descendants_client. However, none of that would protect you from a “compromised guest root”. Oh, and speaking of that: [quote='849418021, sv-vm-dev, /thread/849418, /profile/sv-vm-dev'] Include compromise of the submitting host's administrator. [/quote] I don’t really understand what you mean by this, but if you are trying to protect yourself from root on the host being compromised then, no, that’s not viable. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] To be clear, I’m using agent in the general sens

[quote='910101022, levis46, /thread/850772?answerId=910101022#910101022, /profile/levis46'] If an NEFilterDataProvider remains alive but stops processing callbacks, is there a documented timeout or system-enforced mechanism that prevents unresolved flows from proceeding? [/quote] I don’t really understand this question. The system will wait for your provider to resolve the flow. If your provider never does that, the flow will wait indefinitely (or it’ll cancel based on timeout in the client app). [quote='910101022, levis46, /thread/850772?answerId=910101022#910101022, /profile/levis46'] If the provider has previously issued a partial flow allowance using passBytes and subsequently crashes or becomes unresponsive, can already-authorised bytes continue to pass? [/quote] The becomes unresponsive case is very clear: The bytes that you’ve previously allowed will continue to be allowed, because the system doesn’t really know that your provider is unresponsive. For the crash case: There’s definitely a race condition

[quote='851786021, tmolitor, /thread/851786, /profile/tmolitor'] Feedback ID: FB25211847 [/quote] Thanks! That’s definitely the right path for this report. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

My initial comment is that your overall goal — a sandboxed app that uses Hypervisor framework to run VMs in a one-child-process-per-guest setup — is something that I’d expect to work. However, there are a lot of moving parts here. The first thing I’d like to nail down is this: [quote='851767021, rbmanian75, /thread/851767, /profile/rbmanian75'] 3- When the user attaches a device to a VM, the main app calls -[AAUSBAccessory createXPCRepresentation]. We send the bytes of that xpc_data object to the helper over our existing control channel. [/quote] That’s a bit of a worry given that the method’s return return type is xpc_object_t. My initial research suggests that it’s OK, but I need to do some more research before I can say that definitively. I’ll update this thread when I know more. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I’ll respond there shortly, but first I have a quick request… You open all of your threads in the Developer Tools & Services > Developer Forums subtopic, which is weird because that subtopic is for discussing the forums platform itself. The correct place for VM questions [1] is App & System Services > Core OS. And now I’m off to move your latest thread (-: Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] Well, most VM questions. There are always exceptions, which is one of the reasons we have tags as well as topics.

See: TN3120 Expected use cases for Network Extension packet tunnel providers TN3134 Network Extension provider deployment The take-home message from TN3120 is that DTS doesn’t support ‘off label’ use of packet tunnel provider, for example, using a packet tunnel provider to implement a content filter. TN3134 describes two mechanisms for filtering on unmanaged devices: URL filter provider Content filter provider in the Screen Time case Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Have you tried this on the latest iOS 27.2 beta seed? I’m asking because your bug (FB24975241) was marked as a dup of a bug that’s reported as having improvements in iOS 27.2 beta. I’m not 100% confident that it’ll fix your issue completely, and hence my suggestion to try it out. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I would do this verification in a VM. The immediate issue you’re having is that you’re trying to re-initialise the sandbox. That’s not allowed. Once a process is in a sandbox, it can neither get out of that sandbox nor apply a different sandbox. Furthermore, it looks like the third-party infrastructure you’re using is playing games with a custom SBPL sandbox. That’s not something we support, as I explained in that other thread you found. Finally, the nice thing about using a VM in this context is that you start fresh each time. That guarantees that state from build N of your product doesn’t affect build N+1. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

This recently came up in a different thread, and my responses there go into more detail about what is and isn’t supported in this space. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

There’s not enough info here for folks to help you. For example, you’ve not even mentioned what platform you’re targeting. I recommend that you review Quinn’s Top Ten DevForums Tips, especially tip 7, then craft a specific question in the appropriate subtopic. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

This isn’t something we can help you with here on the forums. Rather, you need to seek help via official channels. For the details, see this post. [quote='851685021, Omnixvpn, /thread/851685, /profile/Omnixvpn'] An earlier case (102913653946, 30 June 2026) got no resolution. A new case 102998191235 was filed today under Development and Technical / Other Development or Technical Questions. [/quote] The format of those case numbers indicates that you’re connected with the right folks, and I encourage you to strive for a resolution via that path. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Virtualization and Hypervisor are very different when it comes to process management. In Virtualization, the OS is responsible for managing the process that runs the VM. This is something we’ve talked about in your previous thread. In Hypervisor that’s not the case. Rather, you are responsible for running the VM. Typically that means starting your own thread to run each vCPU by calling hv_vcpu_run(_:). Given that architecture, your question boils down to “What does QEMU do?”, and that’s not something I can answer. You can either look at the QEMU source or escalate your question via QEMU’s support channel. Oh wait, one of your questions still make sense given the above: [quote='851932021, levis46, /thread/851932, /profile/levis46'] 4- Can any other userspace process retain or acquire resources allowing those vCPUs to continue executing after the original owner has terminated? [/quote] And the answer to that is “No.” Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmai

Kevin and I have have answered a bunch of questions like this recently. I recommend that you review the recent threads in App & System Services > Processes & Concurrency subtopic, think about how our advice applies to your situation, and then come back with your specific questions. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

I can’t help you with third-party tools. If you need help with that, I recommend that you request that help via the support channel for those tools. Before you do that, however, it’d be a good idea to rule out the Apple side of the equation. If you use Apple tools to create a Mac App Store installer package, will Transporter accept that? Any easy way to do this is: Using Xcode, create a new macOS > App project with the same bundle ID as your main app. Choose Product > Archive. In the Xcode organiser, use Validate App to ensure that it’s set up correctly. It’s likely you’ll require a few tweaks, for example, setting up the icon. Once it passes validation, click Distribute App and follow the Custom > App Store Connect > Export workflow. The final result will be a Transporter-ready installer package (.pkg). Try to upload that with Transporter. If it works, you know that the Apple side of this is all good and you can talk with your third-party tooling vendor. If it doesn’t work, there’s something wron