NSUpdateSecurityPolicy don't work or how to request App Managment permission?

Question

rieznikov_bohdan OP

Created Jul ’24

Replies 2

Boosts 0

Participants 2

I have two MAUI Mac Catalyst apps.

According to this guide https://learn.microsoft.com/en-us/dotnet/maui/mac-catalyst/deployment/publish-outside-app-store?view=net-maui-8.0#publish-using-the-command-line

I created certificates, signed Release versions of applications, packed them with pkgbuild and productbuild which I also signed with created certificate

They are both signed with same Code Signing key, have same team id. I had set up NSUpdateSecurityPolicy https://developer.apple.com/documentation/bundleresources/information_property_list/nsupdatesecuritypolicy

like this: Screenshot 2024-07-08 at 15.40.32.png

Using codesign -dv I cheked that updater, old and new versions of app share same Team Id and have correct bundle identifiers

After update, updater wants to overwrite old app contents, but it always receives UnathorizedAccessException when touching any file located in application

If my updater app has "App Managment" or "Full disk access" permission in System settings, everything works fine, but user needs to set up it manualy, that is not comfortable, so how can I request this permission? Also according to what I know, application don't need this permission if it's Team ID set up in NSUpdateSecurityPolicy

Maybe I incorrectly set up NSUpdateSecurityPolicy, but I can't notice anything wrong. Also, can it be because I overwrite application using MAUI and C#? Thanks a lot for any answer!

Answered by rieznikov_bohdan in 795199022

My problem was because of I badly defined NSUpdateSecirityPolicy , turns out I did not specifed key in dictionary because of picture on https://developer.apple.com/documentation/bundleresources/information_property_list/nsupdatesecuritypolicy I thought that dictionary must not have a key

NSUpdateSecurityPolicy should look like this

<key>NSUpdateSecurityPolicy</key>
	<dict>
		<key>AllowPackages</key>
		<array>
			<string>TEAM_ID</string>
		</array>
		<key>AllowProcesses</key>
		<dict>
			<key>TEAM_ID</key>
			<array>
				<string>com.firm.updater</string>
			</array>
		</dict>
	</dict>

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’24

This is almost certainly a side effect from the third-party tools you’re using. I’ve written native code to do this and it worked as expected.

This feature relies on the concept of responsible code, which I defined in my On File System Permissions post. For the system to present an alert to the user, it has to work out which app in responsible for the file system operation. That’s based on heuristics, and if those heuristics break down then macOS doesn’t present the alert. I suspect that there’s something about your third-party runtime that’s causing that, but it’s hard to say what that might be.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

rieznikov_bohdan OP

Jul ’24

Accepted Answer

Recommended

My problem was because of I badly defined NSUpdateSecirityPolicy , turns out I did not specifed key in dictionary because of picture on https://developer.apple.com/documentation/bundleresources/information_property_list/nsupdatesecuritypolicy I thought that dictionary must not have a key

NSUpdateSecurityPolicy should look like this

<key>NSUpdateSecurityPolicy</key>
	<dict>
		<key>AllowPackages</key>
		<array>
			<string>TEAM_ID</string>
		</array>
		<key>AllowProcesses</key>
		<dict>
			<key>TEAM_ID</key>
			<array>
				<string>com.firm.updater</string>
			</array>
		</dict>
	</dict>

0