Signing a command line tool to be run from a sandboxed app

Question

Created Apr ’17

Replies 3

Boosts 0

Views 3.7k

Participants 3

I am trying to run a simple command line utiltity from within the shell of a sandboxed application. The application is signed and sandboxed and runs properly. I am signing the 'hello' binary using the following command, and then display the sandbox.entitlements for the program:

codesign -d --entitlements :- /Applications/Emacs\ Lisp\ Programming\ Environment\ $ELPE$,1.0.18-dev.app/Contents/MacOS/hello

Executable=/Applications/Emacs Lisp Programming Environment (ELPE),1.0.18-dev.app/Contents/MacOS/hello

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>com.apple.security.app-sandbox</key>

<true/>

<key>com.apple.security.network.server</key>

<true/>

<key>com.apple.security.network.client</key>

<true/>

<key>com.apple.security.inherit</key>

<true/>

</dict>

</plist>

The apppplication is installed in /Applications, and the 'hello' program is owned by root:admin.

$ ls /Applications/Emacs\ Lisp\ Programming\ Environment\ $ELPE$,1.0.18-dev.app/Contents/MacOS/ -l

total 25594

-rwxr-xr-x 1 root admin 18869504 2017-04-04 18:13 Emacs

drwxr-xr-x 2 root admin 68 2017-04-04 18:13 bin

-rwxr-xr-x 1 root admin 3723168 2017-04-04 18:13 fossil

-rwxr-xr-x 1 root admin 18464 2017-04-04 18:13 hello

drwxr-xr-x 2 root admin 68 2017-04-04 18:13 libexec

-rwxr-xr-x 1 root admin 1119840 2017-04-04 18:13 urbit

-rw-r--r-- 1 root admin 2476747 2017-04-04 18:13 urbit.pill

When run from the shell of the main application:

~ $ /Applications/Emacs\ Lisp\ Programming\ Environment\ $ELPE$,1.0.18-dev.app/Contents/MacOS/hello

illegal instruction: 4

Any ideas on what I am doing incorrectly that I might need to do to get this command line application working from my sandboxed application?

Thanks in advance.

Boost

Answer 1

NotMyName OP

Apr ’17

Which do you mean:

You're trying to run the command line tool in a shell (e.g. in a shell from inside Terminal, or ssh'ing on to the mac).
You're trying to lauch a shell from your application and have that shell execute (directly or via a script) your command line tool.

?

For case #1, have you tried lldb or gdb to debug the issue? The command line tools (which you can get Xcode to point you to the download link for from the "Xcode/Show Developer Tool/More Developer Tools" menu item) should include a command line debugger if you don't have one already.

0

Answer 2

DTS Engineer OP

Apple

Apr ’17

Accepted Answer

There’s no way to sign a helper tool such that it works from both Terminal and via NSTask (or

fork

/

exec

, or any other sublaunching mechanism) from you sandboxes app. For the latter to work you must set the

com.apple.security.inherit

entitlement (and only that entitlement). However, if you set that entitlement then you won’t be able to run the helper tool from Terminal (because there’s no app sandbox to inherit from).

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 3

BusFactor1 OP

Apr ’17

Turns out I mistakingly wasn't even signing the applications, I just thought I was with an incorrect invocation of codesign. Fixing that solved the problems for me, but thanks for the tip on only requiring that entitlement. That was good to know.

0