Open Radar

 
Summary:
When I use to query the ASL for messages it works fine as long as the caller is not sandboxed.
It fails in sandbox mode

e.g.
I use asl to get ALL messages with:
loglevel doesn't matter
processIdentifier = %OWN_NAME%
time = %SINCE_YESTERDAY%

    aslmsg query = asl_new(ASL_TYPE_QUERY);
    asl_set_query(query, ASL_KEY_SENDER, [applicationName UTF8String], ASL_QUERY_OP_EQUAL);
    asl_set_query(query, ASL_KEY_TIME, [sinceString UTF8String], ASL_QUERY_OP_GREATER_EQUAL);
    aslresponse response = asl_search(NULL, query);

=> it works on ios and on non-sandboxed osx
=> it doesn't work when sandboxed

Steps to Reproduce:
run attached sample and toggle sandboxing in the entitlements file
OR add a an exception to the sandbox:
com.apple.security.temporary-exception.files.absolute-path.read-only = "/"
(home relative doesnt work, guess it needs /var/ or /Library/)

Expected Results:
it should work in both cases especially when the specified SENDER_KEY is equal to the own process name

Actual Results:
it works for iOS and non-sandbox. it fails when sandbox