Skip to content

Commit 1e40416

Browse files
committed
Allow running Mac Catalyst builds in App Sandbox
1 parent e18281d commit 1e40416

File tree

4 files changed

+33
-8
lines changed

4 files changed

+33
-8
lines changed

src/mono/sample/iOS/Makefile

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ USE_LLVM=true
55
AOT?=false
66
TARGET?=iOSSimulator
77
DEPLOY_AND_RUN?=true
8+
APP_SANDBOX?=false
89

910
#If DIAGNOSTIC_PORTS is enabled, RUNTIME_COMPONENTS must also be enabled.
1011
#If RUNTIME_COMPONENTS is enabled, DIAGNOSTIC_PORTS is optional.
@@ -58,7 +59,8 @@ run-catalyst:
5859
/p:TargetArchitecture=$(MONO_ARCH) \
5960
'/p:DeployAndRun="$(DEPLOY_AND_RUN)"' \
6061
/p:UseLLVM=False \
61-
/p:ForceAOT=True
62+
/p:ForceAOT=True \
63+
/p:EnableAppSandbox=$(APP_SANDBOX)
6264

6365
run-sim-interp: clean appbuilder
6466
$(DOTNET) publish \

src/mono/sample/iOS/Program.csproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
<PropertyGroup Condition="'$(TargetOS)' == 'MacCatalyst'">
2020
<DevTeamProvisioning Condition="'$(TargetOS)' == 'MacCatalyst' and '$(DevTeamProvisioning)' == ''">adhoc</DevTeamProvisioning>
21+
<EnableAppSandbox Condition="'$(EnableAppSandbox)' == ''">false</EnableAppSandbox>
2122
</PropertyGroup>
2223

2324
<Import Project="$(RepoTasksDir)AotCompilerTask\MonoAOTCompiler.props" />
@@ -81,6 +82,7 @@
8182
ForceAOT="$(RunAOTCompilation)"
8283
ForceInterpreter="$(MonoForceInterpreter)"
8384
RuntimeComponents="$(RuntimeComponents)"
85+
EnableAppSandbox="$(EnableAppSandbox)"
8486
DiagnosticPorts="$(DiagnosticPorts)"
8587
AppDir="$(MSBuildThisFileDirectory)$(PublishDir)">
8688
<Output TaskParameter="AppBundlePath" PropertyName="AppBundlePath" />

src/tasks/AppleAppBuilder/AppleAppBuilder.cs

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,11 @@ public string TargetOS
158158
/// </summary>
159159
public bool EnableRuntimeLogging { get; set; }
160160

161+
/// <summary>
162+
/// Enables App Sandbox for Mac Catalyst apps
163+
/// </summary>
164+
public bool EnableAppSandbox { get; set; }
165+
161166
public override bool Execute()
162167
{
163168
bool isDevice = (TargetOS == TargetNames.iOS || TargetOS == TargetNames.tvOS);
@@ -229,6 +234,11 @@ public override bool Execute()
229234
throw new ArgumentException("Using DiagnosticPorts require diagnostics_tracing runtime component.");
230235
}
231236

237+
if (EnableAppSandbox && TargetOS != TargetNames.MacCatalyst)
238+
{
239+
throw new InvalidOperationException("App Sandbox can only be enabled for Mac Catalyst builds.");
240+
}
241+
232242
var generator = new Xcode(Log, TargetOS, Arch);
233243

234244
if (GenerateXcodeProject)
@@ -252,7 +262,7 @@ public override bool Execute()
252262
else if (GenerateCMakeProject)
253263
{
254264
generator.GenerateCMake(ProjectName, MainLibraryFileName, assemblerFiles, assemblerFilesToLink,
255-
AppDir, binDir, MonoRuntimeHeaders, !isDevice, UseConsoleUITemplate, ForceAOT, ForceInterpreter, InvariantGlobalization, Optimized, EnableRuntimeLogging, DiagnosticPorts, RuntimeComponents, NativeMainSource);
265+
AppDir, binDir, MonoRuntimeHeaders, !isDevice, UseConsoleUITemplate, ForceAOT, ForceInterpreter, InvariantGlobalization, Optimized, EnableRuntimeLogging, EnableAppSandbox, DiagnosticPorts, RuntimeComponents, NativeMainSource);
256266
}
257267

258268
return true;

src/tasks/AppleAppBuilder/Xcode.cs

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,7 @@ public string GenerateCMake(
201201
bool invariantGlobalization,
202202
bool optimized,
203203
bool enableRuntimeLogging,
204+
bool enableAppSandbox,
204205
string? diagnosticPorts,
205206
string? runtimeComponents=null,
206207
string? nativeMainSource = null)
@@ -236,13 +237,23 @@ public string GenerateCMake(
236237
var entitlements = new List<KeyValuePair<string, string>>();
237238

238239
bool hardenedRuntime = false;
239-
if (Target == TargetNames.MacCatalyst && !forceAOT) {
240-
hardenedRuntime = true;
240+
if (Target == TargetNames.MacCatalyst)
241+
{
242+
if (!forceAOT)
243+
{
244+
hardenedRuntime = true;
245+
246+
/* for mmmap MAP_JIT */
247+
entitlements.Add (KeyValuePair.Create ("com.apple.security.cs.allow-jit", "<true/>"));
248+
/* for loading unsigned dylibs like libicu from outside the bundle or libSystem.Native.dylib from inside */
249+
entitlements.Add (KeyValuePair.Create ("com.apple.security.cs.disable-library-validation", "<true/>"));
250+
}
241251

242-
/* for mmmap MAP_JIT */
243-
entitlements.Add (KeyValuePair.Create ("com.apple.security.cs.allow-jit", "<true/>"));
244-
/* for loading unsigned dylibs like libicu from outside the bundle or libSystem.Native.dylib from inside */
245-
entitlements.Add (KeyValuePair.Create ("com.apple.security.cs.disable-library-validation", "<true/>"));
252+
if (enableAppSandbox)
253+
{
254+
hardenedRuntime = true;
255+
entitlements.Add (KeyValuePair.Create ("com.apple.security.app-sandbox", "<true/>"));
256+
}
246257
}
247258

248259
string cmakeLists = Utils.GetEmbeddedResource("CMakeLists.txt.template")

0 commit comments

Comments
 (0)