com.apple.vm.device-access

Question

Created 1w

Replies 4

Boosts 0

Participants 2

I have an app that needs to seize USB devices, in particular it needs the USBInterfaceOpenSeize call to succeed. I've got a provisioning profile with this entitlement, I've added this plus this entitlement to my app but the USBInterfaceOpenSeize still fails.

Am I correct in thinking this is the correct/only entitlement I need for this?

If so how do I check if I'm using the profile/entitlements correctly?

The call succeeds if I run the application as root which makes me think it's a permissions issue.

Thanks.

Answered by DTS Engineer in 842196022

We are not distributed via the App Store.

So you are able to escalation privileges. That’s generally the path forward I recommend for folks working outside of the Mac App Store.

ps For a summary of the options available to you, see BSD Privilege Escalation on macOS.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

1w

Are you building a hypervisor app for the Mac App Store? Because that’s the only supported use case for com.apple.vm.device-access.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

MikeMcEwenEtc OP

1w

We are a Remote Desktop virtualisation app. We do have com.apple.vm.device-access in our provisioning profile. We are not distributed via the App Store.

0

Answer 3

DTS Engineer OP

Apple

1w

Recommended

We are not distributed via the App Store.

So you are able to escalation privileges. That’s generally the path forward I recommend for folks working outside of the Mac App Store.

ps For a summary of the options available to you, see BSD Privilege Escalation on macOS.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

MikeMcEwenEtc OP

1w

For the record I've now got this working with the entitlement and profile with the addition of using IOServiceAuthorize.

0