macOS App Sandbox Networking and Entitlements
Parent: Apple Platform Publishing (Mac App Store) · Topic entry · 26 branches · skill apple-platform-publishing/references/macos-app-sandbox-networking.md
A published reference is not available for this topic yet.
Also known as: macOS App Sandbox networking for a Mac App Store network/DNS monitor: entitlements, Network.framework, Local Network privacy, interface-bound sockets, SMAppService, CoreWLAN, Developer ID twin build — verify against Apple docs and technotes (macOS 26-27, Oct 2026)
Children
- AllowedWiFiLocalNetworkAddresses CI configuration (frontier)
- App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance (frontier)
- Background Task Management and System Settings Login Items approval (frontier)
- CWWiFiClient event monitoring without Location (frontier)
- CoreWLAN SSID access and Location Services authorization (frontier)
- Embedding a helper tool in a sandboxed app (frontier)
- Hardened Runtime Gatekeeper and notarization for a Developer ID twin build (frontier)
- Interface-bound sockets IP_BOUND_IF and required_interface and sandbox behaviour (frontier)
- Local Network privacy TN3179 NSBonjourServices and detecting a denial (frontier)
- Location usage-string wording for App Review (frontier)
- NECP and includeAllNetworks routing precedence (frontier)
- NWBrowser waiting-state handling for -65570 (frontier)
- NWConnection waiting state and viability handlers (frontier)
- NWParameters requiredInterface vs prohibitedInterfaceTypes (frontier)
- NWPathMonitor requiredInterfaceType and prohibitedInterfaceTypes (frontier)
- Network.framework NWPathMonitor and NWConnection versus SCNetworkReachability (frontier)
- Notarized Developer ID daemon registration (frontier)
- Notarytool CI automation (frontier)
- Provisioning profiles for Developer ID sandboxed builds (frontier)
- SCDynamicStore for DNS and interface change notifications (frontier)
- SMAppService login items and privileged helpers for Mac App Store versus Developer ID (frontier)
- Sparkle or auto-update signing for the twin (frontier)
- TCC responsible-code inheritance for SMAppService agents (frontier)
- XPC from sandboxed app to loginItem helper (frontier)
- XPC service privilege separation (frontier)
- launchd agent AssociatedBundleIdentifiers for helper attribution (frontier)
Frontier under this node: AllowedWiFiLocalNetworkAddresses CI configuration, App Sandbox network entitlements client and server semantics UDP ICMP and child-process inheritance, Background Task Management and System Settings Login Items approval, CWWiFiClient event monitoring without Location, CoreWLAN SSID access and Location Services authorization, Embedding a helper tool in a sandboxed app, Hardened Runtime Gatekeeper and notarization for a Developer ID twin build, Interface-bound sockets IP_BOUND_IF and required_interface and sandbox behaviour, Local Network privacy TN3179 NSBonjourServices and detecting a denial, Location usage-string wording for App Review, NECP and includeAllNetworks routing precedence, NWBrowser waiting-state handling for -65570, NWConnection waiting state and viability handlers, NWParameters requiredInterface vs prohibitedInterfaceTypes, NWPathMonitor requiredInterfaceType and prohibitedInterfaceTypes, Network.framework NWPathMonitor and NWConnection versus SCNetworkReachability, Notarized Developer ID daemon registration, Notarytool CI automation, Provisioning profiles for Developer ID sandboxed builds, SCDynamicStore for DNS and interface change notifications, SMAppService login items and privileged helpers for Mac App Store versus Developer ID, Sparkle or auto-update signing for the twin, TCC responsible-code inheritance for SMAppService agents, XPC from sandboxed app to loginItem helper, XPC service privilege separation, launchd agent AssociatedBundleIdentifiers for helper attribution