Issue with sendto function and osx sandbox

Code Signing General
ar63 OP
Created
Replies 4
Boosts 0
Views 1.3k
Participants 2

My OSX App it's ok and usually it sends same icmp packets with the sendto C function:


ssize_t ssizet = sendto(icmp_socket, &icmp, sizeof(icmp), 0, (struct sockaddr *)&sa, sizeof(sa)); 

if( ssizet==-1 ) 

{

NSLog(@"sendto error %s %d", strerror(errno), errno);

return;

}


Now i have activated the sandbox with this entitlements:


App Sandbox

com.apple.security.network.client

com.apple.security.network.server


The issue is that with sandbox activated the sendto function fails with a "not operation permitted" error.


In console I have found a lot of messages like this


24/03/16 20:44:05,340 sandboxd[115]: ([9013]) myPing(9013) deny network-outbound

so the problem is that the sandbox deny my sendto execution? But why? I have configurated the capabilities as i have show before.


What's my error? Could you say ne what's the issue?

Thanks

Answered by DTS Engineer in 127315022

ICMP, like UDP, requires that you have both the 

com.apple.security.network.client
and
com.apple.security.network.server
entitlements. However, with those entitlements you should be able to send and receive pings just fine. I tried this out with a test project here in my office and it worked as expected. OTOH, if I remove either entitlement I get symptoms very much like the ones you described.

I recommend that you double check your entitlements. Specifically, make sure that your built binary has the right entitlements by running the following command:

$ codesign -d --entitlements :- /path/to/your/binary

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
Replies  4
Boosts 0
Views  1.3k
Participants  2
DTS Engineer OP
Apple
Accepted Answer

ICMP, like UDP, requires that you have both the 

com.apple.security.network.client
and
com.apple.security.network.server
entitlements. However, with those entitlements you should be able to send and receive pings just fine. I tried this out with a test project here in my office and it worked as expected. OTOH, if I remove either entitlement I get symptoms very much like the ones you described.

I recommend that you double check your entitlements. Specifically, make sure that your built binary has the right entitlements by running the following command:

$ codesign -d --entitlements :- /path/to/your/binary

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
ar63 OP

Thanks for your answer.


I have tryed with the client and server entitlements but without results.


The output of codesign command is


Executable=/Users/alberto/Library/Developer/Xcode/DerivedData/iPing-ezoceckicwrbiafaqzxvnkvpkitt/Build/Products/Debug/iPing.app/Contents/MacOS/iPing

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-/

<plist version="1.0">

<dict>

<key>com.apple.security.app-sandbox</key>

<true/>

<key>com.apple.security.network.client</key>

<true/>

<key>com.apple.security.network.server</key>

<true/>

</dict>

</plist>


correct, i think.


If i remove the 3 entitlements and i run the app (that is without sandbox) it run without issues (it send pings and receive the server answers).

DTS Engineer OP
Apple

correct, i think.

Agreed.

I have tryed with the client and server entitlements but without results.

Weird. I literally tried this in my office and it works as expected. If you drop me a line via email (my address is in my signature) I’ll send you a copy of my test project and you can try it for yourself.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware 

let myEmail = "eskimo" + "1" + "@apple.com"
ar63 OP

Thanks!


Alberto