Reading Foreign Preferences & Sandboxing

Originator:peter
Number:rdar://10962312 Date Originated:01-Mar-2012 03:10 PM
Status:Open Resolved:
Product:Mac OS X Product Version:10.7
Classification:Security Reproducible:Always
 
The API CFPreferencesCopyAppValue can be used to read values from preferences that do not belong to your own application. However, with sandboxing this API no longer returns the desired results, because sandboxing policy forbids reading from foreign preferences. 

There are valid use cases where reading those values is still needed. One such case is our open source framework iMediaBrowser, which needs to discover where the iTunes, iPhoto, Aperture, Lightroom, libraries are located. In order to do that we need to peek into com.apple.iapps.plist and read the appropriate keys. Same thing applys to the Lightroom preferences file to find the location of the recent Lightroom libraries. 

For the moment we can work around the issue by using an XPC bundle with a broad temporary exception to file system reading, which lets use locate the appriate plist files, open them and read the key/values pair manually if our own app or the other app is sandboxed. In the future it would be nice if Apple could provide an officially sanctioned SAFE way to access preferences values of other apps (even when one or both parties are sandboxed). This could possibly be achieved by adding an API which let's each application decide which key/value pairs of its own preferences it deems safe to be accessed by other apps - in other words an API to "export" certain key/value pairs.

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!