edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(macos): add network.server entitlement to release sandbox for UDP bind

Browse Source 
apps/chanora_flutter/macos/Runner/Release.entitlements: add com.apple.security.network.server = true. The macOS App Sandbox treats every UDP bind() — including the ephemeral 0.0.0.0:0 that tsclientlib uses for outbound TS3 traffic — as a server operation. Without this entitlement UdpSocket::bind fails with EPERM and the TS3 connect never starts. Debug builds already had this entitlement (needed for flutter run hot-reload); release builds were missing it.

apps/chanora_flutter/macos/Runner/DebugProfile.entitlements: expand the existing network.server comment to document the dual rationale (flutter hot-reload + outbound UDP bind), so the entitlement's purpose is clear without spelunking through tsclientlib.
This commit is contained in:
Edison Jwa
2026-06-07 23:27:46 +09:00
parent d59da05f93
commit 1cf1a8f5a6
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/chanora_flutter/macos/Runner/DebugProfile.entitlements
+4 -2
View File
@@ -2,8 +2,10 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- Flutter default: app-sandbox + JIT for the Dart VM + server
listener for `flutter run` hot-reload. -->
<!-- Flutter default: app-sandbox + JIT for the Dart VM. network.server is
required for the `flutter run` hot-reload listener AND, on macOS, for
every UDP bind() the app does (tsclientlib binds 0.0.0.0:0 for
outbound TS3 traffic and the sandbox treats that as a server op). -->
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.cs.allow-jit</key>
apps/chanora_flutter/macos/Runner/Release.entitlements
+7 -2
View File
@@ -2,12 +2,17 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- Release builds omit the cs.allow-jit + network.server entitlements
used only by Flutter's debug hot-reload. -->
<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
network.server because the macOS App Sandbox treats every UDP bind()
- including the ephemeral 0.0.0.0:0 that tsclientlib uses for
outbound traffic - as a server operation. Without this entitlement
UdpSocket::bind fails with EPERM and the TS3 connect never starts. -->
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<key>com.apple.security.device.audio-input</key>
<true/>
</dict>