Mac OS app entitlements block internet connection - sandbox

I have a Mac OS app that needs outgoing connections.
I've followed Apple Code Signing Guide (Xcode 4.6.2) to enable entitlements and my target summary looks like this:
I have a MYAPP.entitlements file in my project that looks like:
Everything seems to be set in the right way, but when I try to run my app, even if
- (void)webView:(WebView *)sender didStartProvisionalLoadForFrame:(WebFrame *)frame
and
- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame
are called, nothing is loaded in my webView. Nor Little Snitch asks for connection.
Then, in Console no violation is presented.
If I try to change Entitlements setting, by unchecking "Allow Outgoing Connections", Console shows Sandbox violation this way:
20/05/13 00:44:09,000 kernel[0]: Sandbox: sandboxd(908) deny mach-lookup com.apple.coresymbolicationd
20/05/13 00:44:10,593 sandboxd[908]: ([904]) MYAPP(904) deny mach-lookup com.apple.SystemConfiguration.SCNetworkReachability
20/05/13 00:44:10,601 sandboxd[908]: ([904]) MYAPP(904) deny system-socket
If I remove Enable App Sandboxing, everything works and my webView loads its contents...
I have tried:
to exit Xcode
to reboot my computer
to boot in save mode
to enable any combination of permissions in Entitlements
to create a new MYAPP.entitlements file
to rename my target
Anybody has experienced this behavior?
Any suggestion will be very appreciated... Thank you.

Well, I ended up reinstalling my whole system and now it works...

Related

How to do OAuth2 with mobile using cordova (framework7)?

When i run the framework7 (basically cordova inside) with "start dev" => on browser it works.
I'm using "#bity/oauth2-auth-code-pkce": "^2.13.0"
Switching it to android (my app also needs to work for ios) doesn't work anymore. I guess thats cause the redirectUrl which is localhost on browser doesn't suit (no way back from OAuth-Server back to app (not the browser).
I was told to use "custom scheme" so i installed cordova-plugin-customurlscheme too, but it doesn't help when i say redirectUrl = "myChoosenSchemeName://" or something similar.
Am I on the right track? Can someone please tell me what to do to get OAuth2 Server happy with my app (the server responses with "invalid url").
Thanks!

Unable to Accept/Deny the location permission popup on Android devices while executing the scripts on Amazon Device Farm

link of location popup image I am trying to execute the automation scripts(Appium+Java+TestNG/Junit) on Amazon DeviceFarm but while executing, scripts were unable to perform any action((Access/Deny) on Location permission popup.Couldn't see any error logs in console. I have used normal click() operation as well as alert() function. Nothing works in this case.
Please help me.Below is the piece of code that I have tried..
WebDriverWait wait = new WebDriverWait(android, 5);
wait.until(ExpectedConditions.alertIsPresent());
driver.switchTo().alert().dismiss();
}catch(Throwable t) {
System.out.println("Not an alert popup or alert is not present..");
driver.findElement(By.id("idofthelocator")).click();
}
Unfortunately, cap.setCapability(AndroidMobileCapabilityType.AUTO_GRANT_PERMISSIONS, "true"); did not work for me as well. So, I tried finding the locators of the pop-up as usual and then click on same and it worked like a charm. Could you also try finding the locators and clicking on the button as required. Below code works in my case:
`//Location service pop up
#FindBy(id ="com.android.packageinstaller:id/dialog_container")
public WebElement locationPopup;
//Location service allow button
#FindBy(id = "com.android.packageinstaller:id/permission_allow_button")
public WebElement locationPopupAllowButton;
WebDriverWait wait = new WebDriverWait(driver, 20);
wait.until(ExpectedConditions.visibilityOf(locationPopup));
locationPopupAllowButton.click();`
Hope it helps :)
With Android Appium tests it should possible to dismiss permissions popups by setting the capability autoGrantPermission to true. This capability will evaluate the application for the permission it need and run and adb command to grant the app access. Here is the code in the Appium project that does that:
https://github.com/appium/appium-android-driver/blob/959e07d84dc9d09a11735872259ac87511d03b85/lib/android-helpers.js#L334
https://github.com/appium/appium-adb/blob/e6bdc234e7dcf61e0252aad3ac7ab47491fe3720/lib/tools/adb-commands.js#L186
Can you try this capability and let us know if that helps?
With iOS Appium tests the capability autoGrantPermission does NOT work with Appium version less then 1.9.1 because there's not way through Apple APIs to predict the permission necessary or accept them. A workaround is to either find the element manually by printing the page source and checking for it on the fly or use the following lines to take advantage of the selenium methods:
driver.switchTo().alert().accept();
driver.switchTo().alert().dismiss();
In the more recent versions of Appium changes were made to use the autoGrantPermission capability valid with iOS tests. Here is the PR for that request
https://github.com/appium/appium-xcuitest-driver/commit/f5267acab3bc9285161397fa19a8daf60ae0c6ae
Can you let us know which Appium version you're using in this case and provide some of the Appium server logs from the run in Device Farm and your local execution?

ChromeCast(google cast) can't find app name

ChromeCast (google cast) can't find my app name.
I already registered the app in the whitelist.
I can find and launch apps/YouTube, apps/ChromeCast, apps/OldAppName,
but not apps/NewAppName.
Why so? How can I do any thing?
thanks a lot.
Sincoew
Hi Ali Naddaf,
Thanks you for your reply.
I already checked each step by your link again, My app ID is already in whitelist.
I used "//www.gstatic.com/cast/sdk/libs/receiver/2.0.0/cast_receiver.js"
in my receiver app.
but when I Invoke receiver use new app ID, It's return below Error on receiver source code.
(google default)enter code here
case Message.CODE.ERROR_NET_ABORTED:
return new Message(
Message.getLocaleString('BrainFreeze'),
Message.getLocaleString('Sorry'),
Message.getLocaleString('ActivityAborted'));
On ChromeCast "receiver/1.0/cast_receiver.js",
I can found my app use app ID, such as "192.168.xxx.xxx:8008/apps/AppID",
This rule is still can work???
Thanks a lot.
Sincoew
The error source code is in home screen,
http://192.168.xxx.xxx:9222/devtools/devtools.html?xxxxxx
"message.js" file,
This is ChromeCast default home screen source code
I use below receiver:
//github.com/googlecast/cast-custom-receiver/blob/master/sample_media_receiver.html
sender:
1 //github.com/googlecast/cast-sender-tool-chrome
2 our iOS app sender, (google sample)
ps. default app is normal work, YouTube/ChromeCast/old app-ID(version 1.0 js)
and I can found below page use browser,
"192.168.xxx.xxx:8008/apps/YouTube"
"192.168.xxx.xxx:8008/apps/Chromecast"
"192.168.xxx.xxx:8008/apps/old app-ID"
but can't found
"192.168.xxx.xxx:8008/apps/new app-ID"
Thanks a lot,
Sincoew
Most likely your device is not whitelisted. You need to register your chromecast device for your appid and then, follow the instructions in this post to troubleshoot. Also read the development site for chromecast; it has valuable info.

Chromecast "StartApplicationRequest failed with status: -4"

I've set up the Chromecast SDK, whitelisted my device, and am running web servers at the URLs I provided in the whitelist request.
The chromecast tic tac toe app works fine with the default app id "TicTacToe", however changing it to my own: "1813060e-33c5-41dc-b356-0d2bad12497f" or "1813060e-33c5-41dc-b356-0d2bad12497f_1" does not work.
The server url is up and running at http://chromecast.clockworkmod.com/, but no requests are being made to it by Chromecast. The chromecast doesn't display anything. However I get a few errors in the log.
Here is the logcat.
W/StartSessionTask(15590): StartApplicationRequest failed with status:
-4 E/ApplicationSession(15590): StartSessionTask failed with error: failed to start application: request failed D/GameActivity(15590):
start session failed: failed to start application: request failed
I've also tried using the internal app id with the dev url I had provided, http://192.168.1.2:3000/
I found the answer here:
unable to cast to personal whitelisted receiver app
Using the Chromecast app on my Macbook, I went into Settings.
Send serial number when Checking for updates
Reboot device the device using the Mac update app
This resolved the error for me. The chromecast doesn't know if it is whitelisted unless you send the serial during update checks.
I think I see what's missing! In your receiver you gave a link to, you have:
var receiver = new cast.receiver.Receiver(
'GoogleCastSampleApp',
[cast.receiver.RemoteMedia.NAMESPACE],
"",
5);
But it should be (fill in the 'YOUR APP ID HERE' with your App ID)
var receiver = new cast.receiver.Receiver(
'YOUR APP ID HERE',
[cast.receiver.RemoteMedia.NAMESPACE],
"",
5);
I am running into the same error as well. I after setting the Chromecast to send the serial when checking for updates I was finally able to access the debugger one port 9222. Unfortunately, I don't see anything happen on the Chromecast at all when I select it from the device list on my Nexus and try sending one of the demo videos.
Something I noticed and I don't know it makes difference or not but if you whitelist a domain in the GoogleCast extension for Chrome and you include the "http://" it will cause the injection to not work. I wonder if this is the problem with the look up that the Chromecast performs as I submitted my URLs to Google with the http:// prepended. Again I am not sure this should really make a difference but I plan on trying to resubmit the URLs just to see.
Install cURL in your windows machine from here
Now make sure that your device and laptop are in same network.
Now go to command prompt, type curl -d "" http://:8008/apps/YouTube
there If it gets casted automatically to TV then instead of YouTube put your appid and try.
If not then your router is blocking some traffic.

System.Net.WebClient doesn't work with Windows Authentication

I am trying to use System.Net.WebClient in a WinForms application to upload a file to an IIS6 server which has Windows Authentication as
it only 'Authentication' method.
WebClient myWebClient = new WebClient();
myWebClient.Credentials = new System.Net.NetworkCredential(#"boxname\peter", "mypassword");
byte[] responseArray = myWebClient.UploadFile("http://localhost/upload.aspx", fileName);
I get a 'The remote server returned an error: (401) Unauthorized', actually it is a 401.2
Both client and IIS are on the same Windows Server 2003 Dev machine.
When I try to open the page in Firefox and enter the same correct credentials as in the code, the page comes up.
However when using IE8, I get the same 401.2 error.
Tried Chrome and Opera and they both work.
I have 'Enable Integrated Windows Authentication' enabled in the IE Internet options.
The Security Event Log has a Failure Audit:
Logon Failure:
Reason: An error occurred during logon
User Name: peter
Domain: boxname
Logon Type: 3
Logon Process: ÈùÄ
Authentication Package: NTLM
Workstation Name: boxname
Status code: 0xC000006D
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 1476
I used Process Monitor and Fiddler to investigate but to no avail.
Why would this work for 3rd party browsers but not with IE or System.Net.WebClient?
I have seen a similar issue, where the Integrated / NTLM security will only work if you are accessing the host by machine name or localhost. In fact, it is a [poorly] document feature in Windows that is designed to protect against "reflection attacks".
Basically, you need to create a registry key on the machine that is trying to access the server, and whitelist the domain you are trying to hit. Each host name / FQDN needs to be on it's own line - there are no wildcards and the name must match exactly. From the KB Article:
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click MSV1_0, point to New, and then click Multi-String Value.
Type BackConnectionHostNames, and then press ENTER.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
Exit Registry Editor, and then restart the computer.
http://support.microsoft.com/kb/956158/en-us
Have you tried ...
new NetworkCredential( "peter", "password", "boxname" );
You might also try ...
var credCache = new CredentialCache();
credCache.Add( new Uri ("http://localhost/upload.aspx"),
"Negotiate",
new NetworkCredential("peter", "password", "boxname"));
wc.Credentials = credCache;
Also, according to this it may be that IIS is configured wrong. Try replacing "Negotiate" with "Basic" in the above and checking your IIS config for the website. There's also a bunch of possible causes here.
Try going into IE's options and explicitly add the site to the Intranet Zone. Then re-run the program. You should also not run the program from an administrator login. This may trigger the Enhanced Security Configuration for Internet Explorer.
It could explain why you can hit the site with Firefox and Opera, but not with IE or WebClient.
Without knowing your IIS deployment, and assuming that you have the correct authorization rules for upload set in IIS (e.g. the right allow* ACL's on the right dirs you are trying to upload content to, etc), first thing I would try is to set UseDefaultCredentials to true instead of explicitly set Credential. (Maybe you think you are accessing the server with the Credentials you are setting but that's not the case? That would be possible if this works.)
This is a very common scenario, so I would focus on IIS authorization rules for the directory in which you are trying to upload the file, the actual ACL's on that directory. For ex. is your site impersonating or not? if it is, then you have to have actual ACL's on that dir, otherwise whatever account app pool is running on.

Resources