To show badge label, application should be authorized to do it. You should call: UNUserNotificationCenter requestAuthorizationWithOptions with UNAuthorizationOptionBadge on applicationDidFinishLaunching before assigning any badge. After completionHandler is done, you became able to assign badges and them should appear.

What I did found about this issue: The key of described issue is in the answering for ES_EVENT_TYPE_AUTH_OPEN event. How ep_client should answer: If allow all open operations: ep_client should answer with 0xffffffff flag. es_respond_flags_result(aClient, _esMessage, 0xffffffff, aCacheFlag); if deny all open operations: 0x0 if deny only read: 0xffffffff & ~FREAD if deny only write: 0xffffffff & ~FWRITE if deny only read and write but allow others: int32_t flags = 0xffffffff; flags = flags & ~FWRITE; flags = flags & ~FREAD; es_respond_flags_result(aClient, _esMessage, flags, aCacheFlag); Answering in other ways may cause to undefined system behavior, such as described above.

Can you post a code example of how your includedNetworkRules and excludedNetworkRules are setup on your NETransparentProxyNetworkSettings? I believe I get the gist of them but I want to make sure I understand your wildcard rule. The reason why I raise this question is that AirDrop is not working if my extension is up. I thought that I should exclude AirDrop port 8770 from connections. That is why I asked about exclude rules. Code example. Here is how my extension start: - (void)startProxyWithOptions:(NSDictionary *)options   completionHandler:(void (^)(NSError *))completionHandler {   NETransparentProxyNetworkSettings *settings =       [[NETransparentProxyNetworkSettings alloc]         initWithTunnelRemoteAddress:@"127.0.0.1"];   NENetworkRule *rule = [[NENetworkRule alloc]     initWithRemoteNetwork:nil     remotePrefix:0     localNetwork:nil     localPrefix:0     protocol:NENetworkRuleProtocolTCP     direction:NETrafficDirectionOutbound];   settings.includedNetworkRules =     @[       rule     ];   [self setTunnelNetworkSettings:settings     completionHandler:^(NSError * _Nullable error)     {       if (error)       {         NSLog(@"setTunnelNetworkSettings: %@", error.localizedDescription);       }     }];   if (completionHandler != nil)   {     completionHandler(nil);   } } And I always return NO in handleNewFlow: - (BOOL)handleNewFlow:(NEAppProxyFlow *)flow {   return NO; } And AirDrop is not working.

Because your application is under sandbox. Remove sandbox from Signing and Capabilities - it should help.

Here is the answer: https://wiki.freepascal.org/Hardened_runtime_for_macOS

I have the same problem. I cannot block file creation events. So there are files always created with zero size.

Problem solved.

How can I ecologically prevent user to read/write from USB drive? If I deny access to one processes, and allow to other it may brake system consistency. I found that open and save panel is also driven by separate process.

No. The end result here is a provisioning profile template. This allows you to add extra entitlements to a profile when you create it via the developer web site. Xcode is not aware of these templates, so you’ll need to switch to manual signing.Where can I read about this? It should be explained in the request approval email?What will be my next steps once my request approved?In the Xcode project switch to manual signing.Go to Developer account -> "Certificates, Identifiers & Profiles".Click the "+" button, to register a New Provisional Profile.In case if I want to register a profile for distribution, choose "Developer ID" option. Click the "Continue" button.Select App Id, click "Continue" button.Choose your "Developer ID Application" certificate. What if I have a certificate "With Kext"? Should I use it on this step?Enter a profile name, click "Generate" button.To ensure that I am able to use Endpoint Security Client entitlement do the next:Download the generated profile.Quick view it with the space button in Finder.It should have "com.apple.developer.endpoint-security.client: true" listed in the "ENTITLEMENTS" section.Are these steps correct?

Thank You very much 🙂