How to prevent App sandoxing from blocking a plugin usage after codesigning?

Viewed 311

I'm struggling to codesign my Unity application in order to push it to the Mac App Store. I followed the unity recommended process but some issues appeared after the codesign command. I've been able to fix some of them by adding new keys in my entitlement file but i'm still stuck due to the App Sandboxing mecanism.

In my application I use an external plugin named FFmpeg to manage video encoding. After codesigning with the mandatory app sandboxing entitlement set to true, the plugin stopped working and i have no log explaining why.

I tried multiple solutions detailed in other posts like defining an AppSandbox inheritance or adding more keys to my entiltement file but none of them worked.

I'm new to codesigning and here is my process and entitlements file :

  1. chmod -R a+xr ./MY_APP.app
  2. codesign --force --sign '3rd Party Mac Developer Application: My Company (id)' --entitlements ./FFmpeg.entitlements ./MY_APP.app/Contents/Resources/Data/StreamingAssets/FFmpegOut/macOS/ffmpeg
  3. codesign -f --deep -s '3rd Party Mac Developer Application: My Company (id)' --entitlements ./MY_APP.entitlements ./MY_APP.app
  4. Verify codesign & Product build - both successful

The main entitlement file for the app (MY_APP.entitlements):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
            <key>com.apple.security.app-sandbox</key>
            <true/>
            <key>com.apple.security.files.user-selected.read-write</key>
            <true/>
            <key>com.apple.security.network.client</key>
            <true/>
            <key>com.apple.security.files.user-selected.executable</key>
            <true/>
            <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
            <true/>
            <key>com.apple.security.cs.disable-library-validation</key>
            <true/>
            <key>com.apple.security.cs.allow-dyld-environment-variables</key>
            <true/>
            <key>com.apple.security.get-task-allow</key>
            <true/>
    </dict>
</plist>

Here is the second entitlement file (FFmpeg.entiltlement) for the plugin with inheritance:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
            <key>com.apple.security.app-sandbox</key>
            <true/>
            <key>com.apple.security.inherit</key>
            <true/>
    </dict>
</plist>

The plugin i used can be found on github, i'll cross post my issue there as well.

I will gladfully take any idea or solution, Thanks for your help,

Regards, Alexis

0 Answers
Related