Inter process communication between sandboxed Mac app and plugin

Hi,


I have an application

App A
which shares
data
with a macOS DAL plugin using IPC (shared memory). The plugin is loaded in another 3rd party
App B
:
App A <--- data ---> Plugin / App B

Now I am looking for a way to get this working with

App A
being sandboxed. The
App Groups Entitlement
(https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) seems to be the correct tool for allowing IPC between two applications. But the problem with my architecture is, that the communication is between
App A
(whose identifier is known) and a plugin (identifier is known) and a third party
App B
(identifier is not known).

Is there a way to communicate between the sandboxed

App A
and the plugin running in
App B
without knowing
App B
's identifier?


Regards,


P.S: I am targeting the app store with

App A.
Answered by DTS Engineer in 424098022

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Is App B sandboxed?

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

It can be sandboxed.

That makes things challenging. Presumably the plug-in is loaded directly into the App B process, rather than using some sort of XPC Service or app extension. If so, it runs with App B’s sandbox restrictions and, by default, the App Sandbox will not let you reach out and connect to arbitrary services. And you can’t extend the sandbox from your plug-in; that’s under the sole control of App B.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

Accepted Answer

But is it possible to access the shared memory of sandboxed App A from App B assuming that App B is not sandboxed?

What exactly do you mean by “shared memory” in this context?

You added the “xpc” tag to this thread, suggesting that you’re trying to use XPC for this. That’s not going to work because App A can’t register an XPC service in any location that you can ‘see’.

You may be able to make headway with some other IPC mechanism. For example, your plug-in, running within App A, could set up a listening UNIX domain socket in App A’s container. App B, which is not sandboxed, will be able to connect to that UNIX domain socket (assuming that standard BSD permissions allow this, that is, it’s running as the same user). Once that connection is in place you can pass shared memory across the connection using Posix shared memory and UNIX domain socket descriptor passing.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks, this clarfies the situation for me. I will stick with UNIX sockets.

Inter process communication between sandboxed Mac app and plugin
 
 
Q