XPCService and Sandboxing

I have an XPCService which uses a NSTASK to run a PS command.

This service is then called but a Appkit application to get the response from the PS command.

Do I have to enable sandbox on the XPCService if I do I get an Operation not allowed.

I am missing the point here, I though writing a XPCService would get me past this issue ?

Has anyone else run into this problem ?

Cheers Rich

Accepted Answer

Do I have to enable sandbox on the XPCService

Is the goal here to deploy to the Mac App Store (MAS)? If so, then yes, you do have to enable sandboxing on your XPC Service.

if I do I get an Operation not allowed.

That’s not a huge surprise. In general Mac App Store apps are meant to be walled off from other apps and system processes. I presume that

ps
is hitting one of these walls. Do you see a sandbox violation entry the system log?

I am missing the point here, I though writing a XPCService would get me past this issue ?

It would if you disabled sandboxing on your XPC Service. That makes a lot of sense for a non-MAS app, where sandboxing is optional; you can tightly sandbox the main app and then use a set of XPC Services, each with a looser sandbox, to do all the things that the sandbox won’t let your main app do.

However, this isn’t an option for a MAS app, where the app and all of its subsidiary components must be sandboxed.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Ok Thanks for the info, I guess I will have to approach this in a different manner rather than using NSTask.

Its a shame that apple didnt have levels of Sandbox, like for example "user trusted" which would pop up an alert saying this app is going to run a task do you allow it permision, rather than the global sandbox on switch that seems to be affecting developers.


Cheers Richard.

XPCService and Sandboxing
 
 
Q