macOS select TextInputSource programmly sandbox violation

Question

macOS select TextInputSource programmly sandbox violation

I use `TSMSelectInputSource` to select a Input Source, but result in a sandbox violation. The text input source icon in the statusbar was changed , but the desired text input source was not selected. That means the system just change the icon, but if I press some keys on the keyboard, the input source is just the previous one NOT the one I use `TSMSelectInputSource` to select.

Console log of sandboxd:

Sandbox: TextInputSourceM(68220) deny(1) mach-lookup com.apple.tsm.portname (per-pid)
Violation:       deny(1) mach-lookup com.apple.tsm.portname (per-pid)
Process:         TextInputSourceM [68220]
Path:            /Users/andy/Library/Developer/Xcode/DerivedData/MyMacKit-axbcbtdwnqsmstekvhyehnslgeme/Build/Products/Debug/TextInputSourceMaster.app/Contents/MacOS/TextInputSourceMaster
Load Address:    0x10fe80000
Identifier:      com.iamadman.textinputsourcemaster
Version:         6 (1.0)
Code Type:       x86_64 (Native)
Parent Process:  debugserver [68222]
Responsible:     /Users/andy/Library/Developer/Xcode/DerivedData/MyMacKit-axbcbtdwnqsmstekvhyehnslgeme/Build/Products/Debug/TextInputSourceMaster.app/Contents/MacOS/TextInputSourceMaster
User ID:         501


Date/Time:       2023-04-07 15:52:06.851 GMT+8
OS Version:      macOS 12.5 (21G72)
Release Type:    User
Report Version:  8

Posted on Apr 7, 2023 1:02 AM

Reply

Answer 1

MrHoffman

Level 10

152,681 points

Apr 7, 2023 12:06 PM in response to amadman380743909

?

That TSMSelectInputSource call doesn’t seem to be documented?

There are a few stackdumps posted around the ‘net that reference that underneath a Core Foundation call or such, but I can find no Apple doc for the call.

You will want to check for an entitlement (missing? needed?) for whatever is associated with that Mach port.

Reply

Answer 2

Apr 7, 2023 9:03 PM in response to MrHoffman

The `TSMSelectInputSource` is in Carbon.framework/HIToolbox.framework, it's public. I think this API is App Store safe. I developed an app that can switch Text Input Source using global shortcut, user can bind a global shortcut for each Text Input Source, so they do not need to loop through the list. Everything works great when the app was not sandboxed. But If I publish the app to Mac App Store, I must enable sandbox for this app, then all things broken. and I find error logs in the Console.

The TSMSelectInputSource function triggered a sandbox violation: deny(1) mach-lookup com.apple.tsm.portname (per-pid) . I have read the Sandbox Design Guide documentation many times, it doesn't cover this API, so I think this should work.

I also tried adding the mach-lookup com.apple.tsm.portname to entitlements, but stil not work.

<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
<array>
	<string>com.apple.tsm.portname</string>
	<string>com.apple.axserver</string>
</array>

Did I missing anything?

And I also tried to split the app into two parts: main app with sandboxed that can published through Mac App Store, and a XPC service without sandboxed that can not published through Mac App Store, and I need to publish it through other ways

Reply

macOS select TextInputSource programmly sandbox violation

Similar questions