objective c - Launching executable with NSTask - Sandboxing problems? -

i have mac osx application launches executable located in /contents/resources. application not intended released on app store , don't have sandbox turned on.

the launch code:

toolpath = [[[nsbundle mainbundle] pathforresource:@"myexecutable" oftype:@""] copy]; task = [[nstask alloc] init]; [task setlaunchpath: toolpath]; pipe = [[nspipe alloc] init]; [task setarguments:[nsarray arraywithobjects:@"-somearg", somevariable, nil]]; file = [[nsfilehandle alloc] initwithfiledescriptor:[pipe filehandleforreading].filedescriptor]; [task setstandardoutput: stderrpipe]; [task launch]; 

the thing - works fine when running in xcode. works fine when exporting application desktop , running it.

however, if zip application, upload webserver, , download on same computer (or dropbox mac), task no longer launches! no error in system console or anything.

i researched on problem , found osx mark new applicaton "quarantined" special permission right. investigated difference between downloaded app , exported app:

permissions on executable after exporting application xcode:

-rwxr-xr-x  1 username  staff   65724 21 jul 16:31 executablename 

at point app works fine , executable launched button inside app.

and after zipping application, uploaded server, downloaded, unzipped, , opening application , accepting "this application downloaded internet" dialogue:

-rwxr-xr-x  1 username  staff   65724 21 jul 16:31 executablename     com.apple.quarantine        26  

at point nothing happens when push button in app.

if run xattr -rd com.apple.quarantine on whole app, quarantine notice removed:

-rwxr-xr-x  1 username  staff   65724 21 jul 16:31 executablename 

but executable still not being launched!

at point have following permissions on desktop app:

/contents/macos:

-rwxr-xr-x  1 username  staff  407728 21 jul 16:31 appname 

/contents/resources:

-rwxr-xr-x  1 username  staff   65724 21 jul 16:31 executablename 

and on downloaded app used xattr -rd on:

/contents/macos:

-rwxr-xr-x  1 username  staff  407728 21 jul 16:31 appname 

/contents/resources:

-rwxr-xr-x  1 username  staff   65724 21 jul 16:31 executablename 

the first app works fine , second 1 never launches executable. heck going on? it's same app, on same computer, same permissions, downloaded 1 doesnt work.

this problem appears across osx versions on different computers.

adding com.apple.security.inherit entitlement helper app solved problem me.

my helper app used crash could not set sandbox profile data: operation not permitted (1) when tried start nstask.

from apple documentation:

if app employs child process created either posix_spawn function or nstask class, can configure child process inherit sandbox of parent. however, using child process not provide security afforded using xpc service.

enable sandbox inheritance, child target must use 2 app sandbox entitlement keys: com.apple.security.app-sandbox , com.apple.security.inherit. if specify other app sandbox entitlement, system aborts child process. can, however, confer other capabilities child process way of icloud , notification entitlements.

main app in xcode project must never have yes value inherit entitlement.

i hope solution helps.