I don't know much about root issues with apps. But this question seems like it might be useful: https://developer.apple.com/forums/thread/792826
I think that the term "privileged helper" historically referred to an older way for apps to temporarily gain root privileges. Apple didn't like that and pushed people towards launch daemons. Lots more information here: https://developer.apple.com/forums/thread/708765
if one needs these LaunchDaemons to perform some actions with root privileges, what exactly would enabling the App Sandbox (com.apple.security.app-sandbox = true) on the privileged helper tool accomplish? Is there any point in confining a process with root privileges inside a container?
Again, I'm not sure about anything involving root. But I have discovered certain benefits to sandboxing everything. If you have any part that requires (or typically uses) sandboxing, then all parts should be sandboxed. It greatly helps with interoperability between different apps or different components within apps.
If you need to break out of the sandbox, you can do that with an unsandboxed XPCService. But you can only do this with a true XPCService. For other types of XPC communication, then you can't cross the sandbox line.
Topic:
App & System Services
SubTopic:
Processes & Concurrency
Tags: