I’m preparing an update to a native macOS serial logger already distributed through the Mac App Store. The app uses IOSerialBSDClient to enumerate serial ports, opens the selected /dev/cu.* device with open(O_RDWR | O_NOCTTY | O_NONBLOCK), and configures it with termios.
On macOS 27.2, open() returns EPERM with App Sandbox enabled and the USB and Bluetooth entitlements present. The same port opens successfully from a process without App Sandbox. I reproduced this with several adapters.
Apple’s archived Entitlement Key Reference lists com.apple.security.device.serial and describes adding it manually:
https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html
The macOS 27.2 App Sandbox profile still contains a rule for this entitlement, but I couldn’t find it in the current entitlement documentation or in Xcode 27.2’s Signing & Capabilities editor.
Is adding com.apple.security.device.serial manually to the app’s signed entitlements still the supported approach for new Mac App Store updates? Does it require separate approval or provisioning authorization?
If this entitlement is no longer supported for Mac App Store submissions, what does Apple recommend for accessing system-provided BSD serial ports with App Sandbox enabled? The app needs to work with ports exposed by both system and third-party drivers and configure them through termios. Would a temporary file access exception for /dev/ be appropriate for this use case?