# App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance > Source-anchored research for App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance. Run status: COMPLETED. Parent: [macOS App Sandbox Networking and Entitlements](https://llms-explorer.com/tree/macos-app-sandbox-networking/) · 3 facets · 9 facts · page: https://llms-explorer.com/tree/app-sandbox-network-entitlements-client-and-server-semantics-udp-icmp-and-child-process-inheritance/ ## Measurements and reference values - One third-party repo reports socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) succeeds inside a sandboxed macOS app (fd 6, errno 0, gateway 3.96 ms), while a raw ICMP socket needs an entitlement. The macOS version and entitlement set were not stated, and it is unconfirmed by Apple. (low confidence) (verified as of 2026-10-02) — [source](https://github.com/jbcrane13/NetMonitor-2.0/pull/293) ## Problems, failure modes and limitations - On macOS, UDP needs the stronger network.server entitlement in addition to network.client even for outgoing-only use, because the system cannot tell UDP is used solely for outgoing 'connections'. Apple DTS stated this in 2017 for a Network Extension provider (an app extension, same rules). (high confidence) — [source](https://developer.apple.com/forums/thread/72620) - A child process created by fork, posix_spawn or NSTask always inherits the parent's static sandbox. exec of a different sandboxed executable traps (EXC_BREAKPOINT, SYSCALL_SET_PROFILE) because a process cannot change its sandbox. (high confidence) — [source](https://developer.apple.com/forums/thread/747499) ## Facts and statements - In App Sandbox, com.apple.security.network.client covers outgoing connections and com.apple.security.network.server covers listening sockets for incoming connections; both directions can send and receive data, the difference being who initiates. (high confidence) — [source](https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html) - Apple DTS (2016): ICMP, like UDP, requires both network.client and network.server; with both, sending and receiving pings works. Without them sendto fails with EPERM and the sandbox logs 'deny network-outbound'. (high confidence) — [source](https://developer.apple.com/forums/thread/43697) - A developer reported in Oct 2024 that UDP broadcast sendto in a sandboxed app required both entitlements, and that App Review accepted the app with network.server declared. (low confidence) (verified as of 2024-10-01) — [source](https://developer.apple.com/forums/thread/762337) - The network entitlements only apply if App Sandbox is enabled; Hardened Runtime adds no networking checks (Apple DTS, March 2025). A Developer ID twin build that is not sandboxed needs neither entitlement. (medium confidence) (verified as of 2025-03-01) — [source](https://developer.apple.com/forums/thread/775520) - An embedded helper executable you spawn must be signed with exactly com.apple.security.app-sandbox and com.apple.security.inherit; any other sandbox entitlement aborts the child. The child inherits only the parent's static entitlements, not rights granted after launch (e.g. PowerBox). Apple recommends XPC services over child processes. (high confidence) — [source](https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html) - Spawning system tools such as /sbin/ping from a sandboxed app is constrained by the inherited sandbox, so the parent must hold network.client and network.server for ICMP to work; this is inference from the inheritance and ICMP rules, not a documented ping-specific statement. (low confidence) — [source](https://developer.apple.com/forums/thread/43697)