IOSurface with System Extensions

Hi All, I'm working on a camera system extension where the main app is supposed to transfer a video stream using IOSurface memory sharing to the cam extension.

I have built a sample app that does contains all the logic, but without a camera extension. So I'm essentially using IOSurface to render a video in one SwiftUI view and show the result in another SwiftUI view. Just for testing purposes. And everything works fine so far.

Now, when moving the receiver code to the camera extensions, I'm having problems in accessing the IOSurface via ID. I am sharing the IOSurface ID via UserDefaults. I know from the logs the ID is correctly transferred.

Here is the code that uses IOSurfaceLookup to get the IOSurface. But this fails with the given message. The error message prints the surface ID which is the correct one. I know this from the main app where I get the ID and print it as well.

private var surfaceId: Int = -1 {
    didSet {
        logger.info("surfaceId has changed")
        if surfaceId == -1 {
            stopReceivingFrames()
            ioSurface = nil
        } else {
            guard let surface = IOSurfaceLookup(IOSurfaceID(surfaceId)) else {
                logger.error("failed to lookup IOSurface with ID: \(self.surfaceId)")
                return
            }
            self.ioSurface = surface
            logger.info("surface set, now starting receiving frames")
            startReceivingFrames()
        }
    }
}

My gut feeling says that this issue might be related to some missing entitlement, sandboxing. In general, I have a working camera extension. I'm just not able to render a video in the main app, and send it over to the camera extension to overlay another web cam.

Both, the main app and camera extension are in the same XCode workspace and share the same AppGroup.

In short, my actual questions are:

• Is there any entitlement required for using IOSurface between app and camera system extension?
• Is using IOSurface actually possible in system extensions?
• Is there any specific setting/requirement that I need to handle to make this work?