Can a sandboxed macOS app manage other applications windows with user consent?

App Store Distribution & Marketing General
KirilYakimov OP
Created
Replies 2
Boosts 0
Views 192
Participants 3

I'm planning to develop a macOS tiling window manager for potential distribution through the Mac App Store.

Planned Features
  1. Detect application windows and observe focus changes.
  2. Move, resize, and focus windows belonging to other applications.
  3. Organize windows into app-defined virtual workspaces rather than native macOS Spaces.
  4. Display a separate workspace navigation bar without replacing or disabling the native macOS menu bar.
Security and Permissions

The application would:

  • Use only public macOS APIs.
  • Not load user-provided plugins.
  • Not require root privileges.
  • Request explicit Accessibility permission from users.
  • Not replace or disable native macOS functionality.
App Sandbox Considerations

Apple's Protecting User Data with App Sandbox documentation lists "Use of accessibility APIs in assistive apps" as a restricted activity.

Questions

  1. Sandbox restrictions: Does this restriction prevent a sandboxed application from managing windows belonging to other applications, even when the user explicitly grants Accessibility permission?

  2. Supported APIs and entitlements: Are there public macOS APIs or entitlements that allow these window management operations while remaining compliant with App Sandbox requirements?

  3. Mac App Store distribution: Is there an Apple-supported architecture or approach that would allow this functionality to be distributed through the Mac App Store?

Goal

I'd like to confirm the technical feasibility of implementing these features within Apple's App Sandbox and Mac App Store requirements before beginning development.

Answered by DTS Engineer in 913992022
Written by KirilYakimov in 854711021

1- … Does this restriction prevent a sandboxed application from managing windows belonging to other applications … ?

Yes.

Written by KirilYakimov in 854711021

2- … Are there public macOS APIs or entitlements that allow these window management operations while remaining compliant with App Sandbox requirements?

No.

Written by KirilYakimov in 854711021

3- … Is there an Apple-supported architecture or approach that would allow this functionality to be distributed through the Mac App Store?

No.

Given the requirements for your app, I recommend that you distribute it directly, using Developer ID signing.

Written by Tomato in 913882022

You could probably use exception entitlements

It’s possible that you might be able to make progress with temporary exception entitlements. In some cases that’s definitely the right path. I talk about that more in The Case for Sandboxing a Directly Distributed App. However, in this case I don’t think that’s a useful technique because:

  • My experience is that App Review takes a dim view of folks using temporary exception entitlements in Mac App Store apps. Now, keep in mind that I don’t work for App Review, and thus can’t make definitive statements about their policy. If you want to talk to them directly, see here.
  • Regardless of the App Review side of this, there isn’t a good technical approach. There’s no ‘make Accessibility work’ temporary exception entitlement. That means you’d have to rely on other exceptions, like com.apple.security.temporary-exception.mach-lookup.global-name to enable a specific Mach service name. That’s problematic because those Mach service names are not considered API.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies  2
Boosts 0
Views  192
Participants  3
Tomato OP

A sandboxed application cannot bypass Accessibility, I believe. But you may want to ask DTS about it if you have doubts. You could probably use exception entitlements if targets are non-Apple applications.

DTS Engineer OP
Apple
Recommended
Written by KirilYakimov in 854711021

1- … Does this restriction prevent a sandboxed application from managing windows belonging to other applications … ?

Yes.

Written by KirilYakimov in 854711021

2- … Are there public macOS APIs or entitlements that allow these window management operations while remaining compliant with App Sandbox requirements?

No.

Written by KirilYakimov in 854711021

3- … Is there an Apple-supported architecture or approach that would allow this functionality to be distributed through the Mac App Store?

No.

Given the requirements for your app, I recommend that you distribute it directly, using Developer ID signing.

Written by Tomato in 913882022

You could probably use exception entitlements

It’s possible that you might be able to make progress with temporary exception entitlements. In some cases that’s definitely the right path. I talk about that more in The Case for Sandboxing a Directly Distributed App. However, in this case I don’t think that’s a useful technique because:

  • My experience is that App Review takes a dim view of folks using temporary exception entitlements in Mac App Store apps. Now, keep in mind that I don’t work for App Review, and thus can’t make definitive statements about their policy. If you want to talk to them directly, see here.
  • Regardless of the App Review side of this, there isn’t a good technical approach. There’s no ‘make Accessibility work’ temporary exception entitlement. That means you’d have to rely on other exceptions, like com.apple.security.temporary-exception.mach-lookup.global-name to enable a specific Mach service name. That’s problematic because those Mach service names are not considered API.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"