Inter process communication between sandboxed Mac app and plugin

Question

Hi,

I have an application

App A

which shares

data

with a macOS DAL plugin using IPC (shared memory). The plugin is loaded in another 3rd party

App B

:

App A <--- data ---> Plugin / App B

Now I am looking for a way to get this working with

App A

being sandboxed. The

App Groups Entitlement

(https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) seems to be the correct tool for allowing IPC between two applications. But the problem with my architecture is, that the communication is between

App A

(whose identifier is known) and a plugin (identifier is known) and a third party

App B

(identifier is not known).

Is there a way to communicate between the sandboxed

App A

and the plugin running in

App B

without knowing

App B

's identifier?

Regards,

P.S: I am targeting the app store with

App A.

XPC

2.5k

Posted by

HMoc

Reply

Add a Comment

Answer 1

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Answer 2

Is App B sandboxed?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Answer 3

It can be sandboxed.

Posted by

HMoc

Add a Comment

Answer 4

That makes things challenging. Presumably the plug-in is loaded directly into the App B process, rather than using some sort of XPC Service or app extension. If so, it runs with App B’s sandbox restrictions and, by default, the App Sandbox will not let you reach out and connect to arbitrary services. And you can’t extend the sandbox from your plug-in; that’s under the sole control of App B.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Answer 5

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

Posted by

HMoc

Add a Comment

Answer 6

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Answer 7

Thanks, this clarfies the situation for me. I will stick with UNIX sockets.

Posted by

HMoc

Add a Comment

Inter process communication between sandboxed Mac app and plugin

Accepted Reply

Replies