App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance
Parent: macOS App Sandbox Networking and Entitlements · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Measurements and reference values
- One third-party repo reports socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) succeeds inside a sandboxed macOS app (fd 6, errno 0, gateway 3.96 ms), while a raw ICMP socket needs an entitlement. The macOS version and entitlement set were not stated, and it is unconfirmed by Apple. (low confidence) (verified as of 2026-10-02) [source]
Problems, failure modes and limitations
- On macOS, UDP needs the stronger network.server entitlement in addition to network.client even for outgoing-only use, because the system cannot tell UDP is used solely for outgoing 'connections'. Apple DTS stated this in 2017 for a Network Extension provider (an app extension, same rules). (high confidence) [source]
- A child process created by fork, posix_spawn or NSTask always inherits the parent's static sandbox. exec of a different sandboxed executable traps (EXC_BREAKPOINT, SYSCALL_SET_PROFILE) because a process cannot change its sandbox. (high confidence) [source]
Facts and statements
- In App Sandbox, com.apple.security.network.client covers outgoing connections and com.apple.security.network.server covers listening sockets for incoming connections; both directions can send and receive data, the difference being who initiates. (high confidence) [source]
- Apple DTS (2016): ICMP, like UDP, requires both network.client and network.server; with both, sending and receiving pings works. Without them sendto fails with EPERM and the sandbox logs 'deny network-outbound'. (high confidence) [source]
- A developer reported in Oct 2024 that UDP broadcast sendto in a sandboxed app required both entitlements, and that App Review accepted the app with network.server declared. (low confidence) (verified as of 2024-10-01) [source]
- The network entitlements only apply if App Sandbox is enabled; Hardened Runtime adds no networking checks (Apple DTS, March 2025). A Developer ID twin build that is not sandboxed needs neither entitlement. (medium confidence) (verified as of 2025-03-01) [source]
- An embedded helper executable you spawn must be signed with exactly com.apple.security.app-sandbox and com.apple.security.inherit; any other sandbox entitlement aborts the child. The child inherits only the parent's static entitlements, not rights granted after launch (e.g. PowerBox). Apple recommends XPC services over child processes. (high confidence) [source]
- Spawning system tools such as /sbin/ping from a sandboxed app is constrained by the inherited sandbox, so the parent must hold network.client and network.server for ICMP to work; this is inference from the inheritance and ICMP rules, not a documented ping-specific statement. (low confidence) [source]
Children
- No children recorded.