Sandbox with NSTask

Question

I have sandboxing enabled and use /sbin/ping with NSTask:

[task setLaunchPath:@"/sbin/ping"];
[task setArguments:[NSArray arrayWithObjects:@"-c10", iPAddress, nil]];

Everything works great and I get the expected output.

I also want to use /usr/sbin/traceroute with NSTask:

[task setLaunchPath:@"/usr/sbin/traceroute"];
[task setArguments:[NSArray arrayWithObject:iPAddress]];

But the task terminates with the message: NSTask: Task create for path '/usr/sbin/traceroute' failed: 22, "Invalid argument". Terminating temporary process.* At the same time the sandbox logs: deny forbidden-exec-sugid

Why does it work with ping, but not with traceroute ? And how do I make it work with traceroute ?

Thx!

Answer 1

Q1: ping vs. traceroute - the former is a non-priviledged program, the latter is priviledged and runs as root. Your error indicates running as root is not allowed by the sandbox, unsurprising.

Q2: file a bug report with Apple detailing why you need the traceroute functionality and ask for a sandbox supported way of doing it. Given you're actually using the sandbox you're probably a registered Apple developer, so raise it on the dev forums as well (list your bug number).