Inter process communication between sandboxed Mac app and plugin

Question

HMoc OP

Created Jun ’20

Replies 6

Boosts 0

Views 2.8k

Participants 2

Hi,

I have an application

App A

which shares

data

with a macOS DAL plugin using IPC (shared memory). The plugin is loaded in another 3rd party

App B

:

App A <--- data ---> Plugin / App B

Now I am looking for a way to get this working with

App A

being sandboxed. The

App Groups Entitlement

(https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) seems to be the correct tool for allowing IPC between two applications. But the problem with my architecture is, that the communication is between

App A

(whose identifier is known) and a plugin (identifier is known) and a third party

App B

(identifier is not known).

Is there a way to communicate between the sandboxed

App A

and the plugin running in

App B

without knowing

App B

's identifier?

Regards,

P.S: I am targeting the app store with

App A.

Answered by DTS Engineer in 424098022

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Jun ’20

Is App B sandboxed?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

HMoc OP

Jun ’20

It can be sandboxed.

0

Answer 3

DTS Engineer OP

Apple

Jun ’20

That makes things challenging. Presumably the plug-in is loaded directly into the App B process, rather than using some sort of XPC Service or app extension. If so, it runs with App B’s sandbox restrictions and, by default, the App Sandbox will not let you reach out and connect to arbitrary services. And you can’t extend the sandbox from your plug-in; that’s under the sole control of App B.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 4

HMoc OP

Jun ’20

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

0

Answer 5

DTS Engineer OP

Apple

Jun ’20

Accepted Answer

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 6

HMoc OP

Jun ’20

Thanks, this clarfies the situation for me. I will stick with UNIX sockets.

0