Is opening Shared memory allowed in services having App Sandbox Entitlement

Question

Created Nov ’22

Replies 3

Boosts 0

Views 2.7k

Participants 2

I am try to open SYSTEM V Shared Memory in my app which has App sandbox capability/entitlement enabled. But the system is failing at: ftok() function call.

How can I open create a shared memory in such cases, we know we do have a container folder at '~/Library/Containers' where the app has exclusive read write permission. Is there a way to associate a file this container folder to map the shared memory?

Note I want to open a shared memory to be sued between the apps/service which are in same app group. And I am not looking to any alternate sharing method like XPC..

I am creating this shared memory between by App and network extension service.

Answered by DTS Engineer in 736261022

System V IPC is a compatibility API an macOS. We recommend against using it in new code. Given that, it shouldn’t come as a big surprise that it doesn’t have a good story regarding the App Sandbox.

If you want to share memory with that style of API, use Posix shared memory (shm_open and friends). Sandboxed processes can share that via an App Group. See IPC and POSIX Semaphores and Shared Memory in the App Sandbox Design Guide.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

vismacdeveloper OP

Nov ’22

I further checked it and found that it is shmget function call which is failing and below is the error in logs:

2022-11-15 11:02:45.051915+0530 0x2da Error 0x0 132 0 sandboxd: [com.apple.sandbox.reporting:violation] Sandbox: com.mycompanysecur(86334) deny(1) ipc-sysv-shm Violation: deny(1) ipc-sysv-shm Process: com.skyhighsecur [86334] Path: /Library/SystemExtensions/DBAD18A1-0222-46DE-BDCE-C79C93F32254/com.mycompanysecurity.epclient.networkextension.systemextension/Contents/MacOS/com.mycompanysecurity.epclient.networkextension Load Address: 0x1000b8000 Identifier: com.mycompanysecurity.epclient.networkextension Version: 1 (1.0) Code Type: x86_64 (Native) Parent Process: launchd [1] Responsible: /Library/SystemExtensions/DBAD18A1-0222-46DE-BDCE-C79C93F32254/com.mycompanysecurity.epclient.networkextension.systemextension/Contents/MacOS/com.mycompanysecurity.epclient.networkextension User ID: 0

Date/Time: 2022-11-15 11:02:44.963 GMT+5:30 OS Version: macOS 11.6.5 (20G517) Report Version: 8

MetaData: {"profile-in-collection":false,"action":"deny","build":"macOS 11.6.5 (20G517)","platform_binary":"no","uid":0,"summary":"deny(1) ipc-sysv-shm","hardware":"Mac","flags":5,"signing-id":"com.mycompanysecurity.epclient.networkextension","errno":1,"process-path":"/Library/SystemExtensions/DBAD18A1-0222-46DE-BDCE-C79C93F32254/com.mycompanysecurity.epclient.networkextension.systemextension/Contents/MacOS/com.mycompanysecurity.epclient.networkextension","profile-flags":0,"container":"/private/var/root/Library/Containers/com.mycompanysecurity.epclient.networkextension/Data","team-id":"W6824P2V89","pid":86334,"apple-internal":false,"process":"com.mycompanysecur","responsible-process-path":"/Library/SystemExtensions/DBAD18A1-0222-46DE-BDCE-C79C93F32254/com.mycompanysecurity.epclient.networkextension.systemextension/Contents/MacOS/com.mycompanysecurity.epclient.networkextension","operation":"ipc-sysv-shm","platform-binary":false,"platform-policy":false}

Is there any way, by adding any new capability or runtime exception we can allow SystemV Shared memory functions/feature in an App With Sandbox capability?

0

Answer 2

DTS Engineer OP

Apple

Nov ’22

Accepted Answer

System V IPC is a compatibility API an macOS. We recommend against using it in new code. Given that, it shouldn’t come as a big surprise that it doesn’t have a good story regarding the App Sandbox.

If you want to share memory with that style of API, use Posix shared memory (shm_open and friends). Sandboxed processes can share that via an App Group. See IPC and POSIX Semaphores and Shared Memory in the App Sandbox Design Guide.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 3

vismacdeveloper OP

Nov ’22

Yes POSIX shared did work, but we need to keep group name very small to make it work Thanks for help

Cheers

0