Here is the answer: https://wiki.freepascal.org/Hardened_runtime_for_macOS

Because your application is under sandbox. Remove sandbox from Signing and Capabilities - it should help.

Can you post a code example of how your includedNetworkRules and excludedNetworkRules are setup on your NETransparentProxyNetworkSettings? I believe I get the gist of them but I want to make sure I understand your wildcard rule. The reason why I raise this question is that AirDrop is not working if my extension is up. I thought that I should exclude AirDrop port 8770 from connections. That is why I asked about exclude rules. Code example. Here is how my extension start: - (void)startProxyWithOptions:(NSDictionary *)options   completionHandler:(void (^)(NSError *))completionHandler {   NETransparentProxyNetworkSettings *settings =       [[NETransparentProxyNetworkSettings alloc]         initWithTunnelRemoteAddress:@"127.0.0.1"];   NENetworkRule *rule = [[NENetworkRule alloc]     initWithRemoteNetwork:nil     remotePrefix:0     localNetwork:nil     localPrefix:0     protocol:NENetworkRuleProtocolTCP     direction:NETrafficDirectionOutbound];   settings.includedNetworkRules =     @[       rule     ];   [self setTunnelNetworkSettings:settings     completionHandler:^(NSError * _Nullable error)     {       if (error)       {         NSLog(@"setTunnelNetworkSettings: %@", error.localizedDescription);       }     }];   if (completionHandler != nil)   {     completionHandler(nil);   } } And I always return NO in handleNewFlow: - (BOOL)handleNewFlow:(NEAppProxyFlow *)flow {   return NO; } And AirDrop is not working.

What I did found about this issue: The key of described issue is in the answering for ES_EVENT_TYPE_AUTH_OPEN event. How ep_client should answer: If allow all open operations: ep_client should answer with 0xffffffff flag. es_respond_flags_result(aClient, _esMessage, 0xffffffff, aCacheFlag); if deny all open operations: 0x0 if deny only read: 0xffffffff & ~FREAD if deny only write: 0xffffffff & ~FWRITE if deny only read and write but allow others: int32_t flags = 0xffffffff; flags = flags & ~FWRITE; flags = flags & ~FREAD; es_respond_flags_result(aClient, _esMessage, flags, aCacheFlag); Answering in other ways may cause to undefined system behavior, such as described above.

To show badge label, application should be authorized to do it. You should call: UNUserNotificationCenter requestAuthorizationWithOptions with UNAuthorizationOptionBadge on applicationDidFinishLaunching before assigning any badge. After completionHandler is done, you became able to assign badges and them should appear.