NEExtension - From App Extension to System Extension

I'm using keychain groups, so I would be able to get the user's password from the keychain both from app and from the Extension, is it possible to do also with a system extension?
I'm passing data between the containing app and the extension via 'App Groups' ("shared" user defaults). Can I do the same for the system extension?

System Extensions do not run with the same permission as a container app or an app extension. Therefore when you access an App Group or Keychain Group in this context you are accessing a different container than the container app or app extension is.

A similar question, but this time for a certificate - I have the entitlement for managed.vpn.shared - is it possible to use also from the system extension, and get the certificate for the VPN?

Unsure; It depends on where the profile ingestion process puts the keychain item on whether this will work or not. To know for sure, I would attempt to spin up a test.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Thanks Matt!

Regarding "Therefore when you access an App Group or Keychain Group in this context you are accessing a different container than the container app or app extension is."
So that means I can't save something at the userDefaults and read it at the App Extension.
Is there any way that some info can be saved at the containing app, and the system extension will have access to this information?
(not a message between the app and the sys extension, but a write at the app, and read at a later stage at the extension)

Is there any way that some info can be saved at the containing app, and the system extension will have access to this information?
(not a message between the app and the sys extension, but a write at the app, and read at a later stage at the extension)

You could conceivably try using a system daemon to handle writes and reads, but this is a lot of overhead, and possibly headaches, if you are only talking about small amounts of data. Probably a more suitable workflow would be to save data in the container app as usual and then send over the data to the provider with sendProviderMessage and receive with handleAppMessage.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Got it, thanks!
So the only remaining question is about managed.vpn.shared