1 Reply
      Latest reply: Oct 18, 2016 12:57 AM by eskimo RSS
      gietal Level 1 Level 1 (0 points)

        Hi all,

         

        I have a question regarding USB entitlement in sandboxed app, specifically this key: “com.apple.security.device.usb”

        • Does the entitlement include USB device enumeration?
        • Which classes of USB devices are included?

         

        the documentation here https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple_ref/doc/uid/TP40011195-CH4-SW11

        only mentined this:

        "USB access enables the ability to interact with USB devices using USB device access APIs. On violation, sandboxd names the I/O Kit class your code tried to access"

         

        which doesnt really answer my questions. any help is appreciated

         

        thanks!

        • Re: App Sandbox USB device entitlement
          eskimo Apple Staff Apple Staff (6,785 points)
          • Does the entitlement include USB device enumeration?

          What do you mean by USB device enumeration?  In general USB devices show up in the I/O Registry, and that’s available to all sandboxed apps, even those without the com.apple.security.device.usb entitlement.

          • Which classes of USB devices are included?

          I don’t think there’s any restrictions here, although you will have the usual problems with devices that are in use by the system (mass storage being the most notable example).


          If you want to see what entitlements like this do, you can take a look at their use in various profiles in /System//Library/Sandbox/Profiles.  For example, com.apple.security.device.usb is only used in /System/Library/Sandbox/Profiles/application.sb, where it gates access to IOHIDLibUserClient, IOUSBDeviceUserClientV2 and IOUSBInterfaceUserClientV3.

          WARNING The location and contents of these sandbox profiles is not API.  It’s fine to poke around in them to get a better understanding of how the system works, but your app should not rely on their fine structure.

          Share and Enjoy

          Quinn “The Eskimo!”
          Apple Developer Relations, Developer Technical Support, Core OS/Hardware
          let myEmail = "eskimo" + "1" + "@apple.com"