I use bellow entitlement file to sign My.app.
- Code: Select all
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key> <true/>
<key>com.apple.security.network.client</key> <true/>
<key>com.apple.security.device.audio-input</key> <true/>
<key>com.apple.security.files.bookmarks.app-scope</key><true/>
<key>com.apple.security.files.bookmarks.document-scope</key> <true/>
<key>com.apple.security.files.user-selected.read-write</key> <true/>
<key>com.apple.security.assets.movies.read-write</key> <true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/>
<key>com.apple.security.cs.allow-dyld-environment-variables</key> <true/>
<key>com.apple.security.cs.disable-library-validation</key> <true/>
<key>com.apple.security.cs.disable-executable-page-protection</key> <true/>
<key>com.apple.security.cs.allow-jit</key> <true/>
<key>com.apple.security.application-groups</key>
<array>
<string>XXXXXTEAMID.com.abcdec</string>
</array>
</dict>
</plist>
and use bellow entitlement file to sign My Helper.app , My Helper (GPU).app , My Helper (Renderer).app , My Helper (Plugin).app.
- Code: Select all
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key> <true/>
<key>com.apple.security.inherit</key><true/>
</dict>
</plist>
my helper code:
- Code: Select all
int main(int argc, char* argv[]) {
#if defined(CEF_USE_SANDBOX)
// Initialize the macOS sandbox for this helper process.
CefScopedSandboxContext sandbox_context;
bool sandbox_context_init = sandbox_context.Initialize(argc, argv);
if (!sandbox_context_init)
return 1;
#endif
// Load the CEF framework library at runtime instead of linking directly
// as required by the macOS sandbox implementation.
CefScopedLibraryLoader library_loader;
if (!library_loader.LoadInHelper()) {
return 1;
}
// Provide CEF with command-line arguments.
CefMainArgs main_args(argc, argv);
// Execute the sub-process.
int ret = CefExecuteProcess(main_args, nullptr, nullptr);
return ret;
}
the main process My.app is under sandbox and the sub processes are under sandbox because they inherit entitlement of My.app.
When I run program I got error below:
- Code: Select all
sandbox initialization failed: Operation not permitted
[1022/120514.509052:ERROR:gpu_process_host.cc(974)] GPU process exited unexpectedly: exit_code=256
[1022/120514.509281:WARNING:gpu_process_host.cc(1276)] The GPU process has crashed 1 time(s)
[1022/120514.510257:ERROR:network_service_instance_impl.cc(499)] Network service crashed, restarting service.
does the chrome CefScopedLibraryLoader conflict with the Apple sandbox ?
And how can I fix this issue, Thank you.