Issue with sendto function and osx sandbox

Question

Created Mar ’16

Replies 4

Boosts 0

Views 1.2k

Participants 2

My OSX App it's ok and usually it sends same icmp packets with the sendto C function:

ssize_t ssizet = sendto(icmp_socket, &icmp, sizeof(icmp), 0, (struct sockaddr *)&sa, sizeof(sa));

if( ssizet==-1 )

{

NSLog(@"sendto error %s %d", strerror(errno), errno);

return;

Now i have activated the sandbox with this entitlements:

App Sandbox

com.apple.security.network.client

com.apple.security.network.server

The issue is that with sandbox activated the sendto function fails with a "not operation permitted" error.

In console I have found a lot of messages like this

24/03/16 20:44:05,340 sandboxd[115]: ([9013]) myPing(9013) deny network-outbound

so the problem is that the sandbox deny my sendto execution? But why? I have configurated the capabilities as i have show before.

What's my error? Could you say ne what's the issue?

Thanks

Boost

Answer 1

DTS Engineer OP

Apple

Mar ’16

Accepted Answer

ICMP, like UDP, requires that you have both the

com.apple.security.network.client

and

com.apple.security.network.server

entitlements. However, with those entitlements you should be able to send and receive pings just fine. I tried this out with a test project here in my office and it worked as expected. OTOH, if I remove either entitlement I get symptoms very much like the ones you described.

I recommend that you double check your entitlements. Specifically, make sure that your built binary has the right entitlements by running the following command:

$ codesign -d --entitlements :- /path/to/your/binary

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

ar63 OP

Mar ’16

Thanks for your answer.

I have tryed with the client and server entitlements but without results.

The output of codesign command is

Executable=/Users/alberto/Library/Developer/Xcode/DerivedData/iPing-ezoceckicwrbiafaqzxvnkvpkitt/Build/Products/Debug/iPing.app/Contents/MacOS/iPing

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-/

<dict>

<key>com.apple.security.app-sandbox</key>

<true/>

<key>com.apple.security.network.client</key>

<true/>

<key>com.apple.security.network.server</key>

<true/>

</dict>

</plist>

correct, i think.

If i remove the 3 entitlements and i run the app (that is without sandbox) it run without issues (it send pings and receive the server answers).

0

Answer 3

DTS Engineer OP

Apple

Mar ’16

correct, i think.

Agreed.

I have tryed with the client and server entitlements but without results.

Weird. I literally tried this in my office and it works as expected. If you drop me a line via email (my address is in my signature) I’ll send you a copy of my test project and you can try it for yourself.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 4

ar63 OP

Mar ’16

Thanks!

Alberto

0