Supported diagnosis for posix_spawn EPERM when launching a sandboxed local QA host

App & System Services Processes & Concurrency
byron610 OP
Created
Replies 1
Boosts 0
Views 158
Participants 2

On macOS 15.7.9 (24G830), arm64, using Xcode 16.4 (16F6), a locally built QA host fails to launch through LaunchServices using open -W. The recorded signature is ad hoc, with no TeamIdentifier; its only recorded effective entitlement is com.apple.security.app-sandbox=true.

The historical launch returned -10810. Correlated logs report posix_spawn: Operation not permitted (errno 1). Host entry was not observed.

A packaging revision embedded the same Info.plist in __TEXT,__info_plist. Recorded signature verification succeeded, but the next launch produced the same rejection. The responsible policy remains unidentified; these observations are not an independently validated minimal reproducer.

What supported diagnostic procedure can identify the policy responsible for this rejection without disabling security protections or using an alternative launch route?

Replies  1
Boosts 0
Views  158
Participants  2
DTS Engineer OP
Apple

I’d like to clarify your setup here. There are two things in play here:

  • The process doing the launching.
  • The program being launched.

It seems like the latter is your “locally built QA host”, which is sandboxed. However, the error seems to be with launching that, so its sandboxing is probably not relevant. You need to look in to the environment of the process doing the launching.

However, there’s a simple diagnostic you can take to confirm that: Temporarily remove the sandbox on your “locally built QA host”. If you still see the problem, that confirms that its sandboxing isn’t the issue.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"