com.apple.vm.networking for helper binary

So this is a potential minefield [1], but I think you can make it work. The trick is to put the tool in an app-like wrapper [2], with its own bundle ID, and hence its own App ID, and then enable the VM Networking capability on that App ID. The tool then claims the required entitlements, with com.apple.vm.networking being a restricted entitlement that’s authorised by the tool’s provisioning profile.

I tried this in my office today (on macOS 26.7.1) and it seems to work a treat. Consider this:

% codesign -d --entitlements - EntitlementInheritanceExplorer.app/Contents/MacOS/EntitlementInheritanceChild.app 
…
[Dict]
    [Key] com.apple.application-identifier
    [Value]
        [String] SKMME9E2Y8.com.example.apple-samplecode.Child
    [Key] com.apple.developer.team-identifier
    [Value]
        [String] SKMME9E2Y8
    [Key] com.apple.security.app-sandbox
    [Value]
        [Bool] true
    [Key] com.apple.security.get-task-allow
    [Value]
        [Bool] true
    [Key] com.apple.security.inherit
    [Value]
        [Bool] true
    [Key] com.apple.vm.networking
    [Value]
        [Bool] true
% security cms -D -i EntitlementInheritanceExplorer.app/Contents/MacOS/EntitlementInheritanceChild.app/Contents/embedded.provisionprofile | plutil -p -
{
  …
  "Entitlements" => {
    "com.apple.application-identifier" => "SKMME9E2Y8.com.example.apple-samplecode.Child"
    "com.apple.developer.team-identifier" => "SKMME9E2Y8"
    "com.apple.vm.networking" => true
    "keychain-access-groups" => [
      0 => "SKMME9E2Y8.*"
    ]
  }
  …
}

When I have the parent spawn the child, it logs confirmation that it ran with the right entitlements and with the entitlements-validated flag set (the full log entries are at the end of this reply).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Due to the combination of sandbox inheritance (see Resolving App Sandbox Inheritance Problems) and the entitlements-validated flag (see App Groups: macOS vs iOS: Working Towards Harmony).

[2] See Signing a daemon with a restricted entitlement.

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: first light

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: is validated: true

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.application-identifier = SKMME9E2Y8.com.example.apple-samplecode.Child

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.developer.team-identifier = SKMME9E2Y8

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.security.app-sandbox = 1

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.security.get-task-allow = 1

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.security.inherit = 1

…
process: EntitlementInheritanceChild
subsystem: com.example.apple-samplecode.EntitlementInheritanceExplorer
category: child
message: entitlement: com.apple.vm.networking = 1

I got this working as you said i need to create a app wrapper and from dts support i came to know that the restricted entitlement is approved for team id and not for bundle id. so the the helper worked perfectly after wrapping it in app.

Thank You

Now i have one more problme i need to add microphone cabaility to helper app when i enable the audio input the helper application does not start it exit with code 5. How can i add audio input to the helper app.

thanks in advance

You mean com.apple.security.device.microphone, right?

Because there’s the confusingly similar com.apple.security.device.audio-input |-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I mean both i tried enabling it in xcode when i enable microphone the other enabled automatically. when i run the helper binary with this entitlement it crashes with exit code 5. Do we really need this in helper binary. What the helper binary does in the sense it runs virtual machine in a separate process using hypervisor framework they are sandboxed and inherit secuirty and i have hypervisor and vm.networking in the entitlements. the vm records audio from mac mic. so the helper needs microphone permission technically speaking. but however withtout the microphone entitilements the recoding works. is there something i am missing to understand.

I mean both

OK.

I think you’re being bitten by the com.apple.security.inherit oddity that I discuss here.

but however withtout the microphone entitilements the recoding works.

Do you have these entitlements on the app itself, that is, the parent that spawned the helper child?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Do you have these entitlements on the app itself, that is, the parent that spawned the helper child?

Yes I have it in the parent. i have two way of running the vms. one using virtualization framework for macos and linux vms ie in process and helper worker binary for running windows vm with hypervisor framework.