edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(macos): clarify network.server entitlement justification

Browse Source 
Oracle re-review nit on PR #27: cite Apple's App Sandbox semantics
explicitly. The macOS sandbox classifies any UDP bind() against a
local port as a 'server' operation (covered by network.server),
even when the socket is only used to sendto() a remote peer. This
is the bind()-then-sendto() pattern tokio's UdpSocket uses
internally for tsclientlib's outbound voice traffic. Correct the
sandbox log line to the actual deny string ('Sandbox: ... deny(1)
network-bind') and reference Apple's entitlement reference wording.
This commit is contained in:
Edison Jwa
2026-06-07 23:27:46 +09:00
parent c40705790a
commit e9cd832828
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/chanora_flutter/macos/Runner/Release.entitlements
+13 -7
View File
@@ -3,13 +3,19 @@
<plist version="1.0">
<dict>
<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
network.server because the macOS App Sandbox treats every UDP bind()
- including the ephemeral 0.0.0.0:0 that tsclientlib's
tokio::net::UdpSocket::bind() issues for outbound traffic - as a
server operation. Without this entitlement UdpSocket::bind fails
with EPERM (sandbox_init: 'network-outbound deny') and the TS3
connect never starts. network.client alone is insufficient because
it gates connect()-style flows, not bind()-then-sendto. -->
network.server because the macOS App Sandbox classifies UDP bind()
against a local port - including the ephemeral 0.0.0.0:0 that
tsclientlib's tokio::net::UdpSocket::bind() issues for outbound
voice traffic - as a server operation that requires
com.apple.security.network.server, regardless of whether the
socket is later used only to sendto() a remote peer. Without it,
bind() returns EPERM and the sandbox log records
"Sandbox: chanora(...) deny(1) network-bind". network.client
alone gates outbound connect()-style flows (TCP, connected UDP)
and is insufficient for the bind()-then-sendto() pattern Tokio's
UdpSocket uses. See Apple's App Sandbox entitlement reference:
"Network Server" covers any process that listens on, or binds
to, a network port. -->
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.network.client</key>