We solved it by letting the user pick the folder in sandboxed mode using NsOpenPanel and we save the bookmarks for future use. This is an extra step user has to do it. It would be nice if we could avoid this steps for the user.

[quote='913473022, DTS Engineer, /thread/854131?answerId=913473022#913473022'] Do you have to install directly to this USB drive? [/quote] Yes i need to directly install into usb drive. i can get this working for guest linux and windows and they are working fine. But for macOS i can install second guest instllation to usb storage in addition to that of the guest os in internal drive as we do now with phsical mac. This raises me anothe question. why it is not possible to connect thunderbolt storages/devices directly to guest os? Is it possible to do in appstore sandbox mode. Thanks

Thanks for looking into this. My app doesn't use NSOpenPanel. The URLs come from the File Provider API itself. The containing app (sandboxed, same app group as the extension) does this: It records the new items in the app group and calls signalEnumerator(for: .workingSet). Once the items are enumerated, it gets each placeholder's URL with NSFileProviderManager.getUserVisibleURL(for:): manager.getUserVisibleURL(for: identifier) { url, error in // url is ~/Library/CloudStorage/<App>-<Domain>/…/File.bin; the placeholder exists and is dataless } It writes the URLs to the pasteboard: let pasteboard = NSPasteboard.general pasteboard.clearContents() pasteboard.writeObjects(urls as [NSURL]) // same result with NSPasteboardItem + .fileURL The pasteboard write is where Sandbox extension creation failed … (error -20) appears. The user can't pick these files with an open panel. The feature is clipboard sharing with a virtual machine: when the user copies files inside the VM, the app puts placeholders for them on the Mac clipboard. The data is fetched only when the user pastes in Finder (fetchContents). So the app has to write the URLs without any user interaction, right after the copy. A few follow-up questions: Since the URLs come from NSFileProviderManager for the app's own domain, should the containing app be able to write them to the pasteboard? Or is a URL from getUserVisibleURL(for:) treated like any other path outside the sandbox? Is there a supported way for the containing app to get access to its own domain's user-visible folder, for example a security-scoped URL or bookmark issued by NSFileProviderManager? With that, the pasteboard could create the sandbox extension. If not, is there another supported way to hand placeholder files to Finder for pasting, for example something the extension itself can write? I'll contact App Review separately about the temporary-exception entitlement. Environment: macOS 27.2, Developer ID build, App Sandbox on; the extension is an NSFileProviderReplicatedExtension.

Here is the bug fb no. FB25324561

Update: resolved on our side. We still use the legacy IOUSBLib interface API. We still use AccessoryAccess and IOUSBHostDevice for the device, and the legacy IOUSBLib interface API (IOUSBInterfaceInterface942) for interfaces and pipes, because the sandbox has no rule for the IOUSBHostInterface user client. We would move back to IOUSBHost if that changes. New problem: a Realtek 0x0BDA:0x8156 2.5GbE adapter worked twice, then failed on every third attach in the guest (device disabled or "not connected"). A USB flash drive was never affected. The failing sessions had one thing in common: control requests on the default pipe returned kIOReturnNotReady (0xE00002D8) from the first request until the guest gave up. The same device, opened again a moment later, answered normally. Fix, in our helper's open path, before the device is shown to the guest: After -openWithServiceQueue:completionHandler: returns, poll GET_STATUS for up to 1.5 s. Anything other than kIOReturnNotReady counts as ready. If the device is still NotReady, call -destroy and -closeWithCompletionHandler:, wait 0.5 s and open a fresh AAUSBAccessory from the same XPC representation. Up to 4 attempts. The adapter now attaches and detaches repeatedly on M4 and M5 MacBook Air. Questions: Is NotReady on an accessory opened right after release expected? Is there a notification or property that signals readiness, so we need not poll? Is there a reset that keeps the AccessoryAccess handle valid? -resetWithError: invalidates it. What is the recommended modern approach for this? We would like to use IOUSBHostInterface and IOUSBHostPipe for interfaces and transfers instead of the legacy IOUSBLib API, from a sandboxed helper that inherits the app's sandbox, with only AccessoryAccess and com.apple.security.device.usb. Is there a supported way to obtain the interfaces of an accessory opened through AccessoryAccess, or a sandbox rule or entitlement for AppleUSBHostFrameworkInterfaceClient, so we can drop the legacy path? Thank you.

Sure i will post in the right place nowonwards. thank you for correcting me

it is working with the legacy method by using createXPC on m5 macbook air for m4 macbook air i have to do some tweaking to get it to work. usb flash drives are getting connected and disconnected safely and it works ok. but when i connect usb ethernet adapter it is not reliable. some times the adapter is getting connected but it is in disabled state. disconnect and connecting again resolves the problem. this is the only problem i have. but with the modern approach i need to have temporary exception to get it to work. without that usb devices are connecting but they are not working. so my question is there a way we can make use of the modern api without temporary exception because appstore review dont encourage using this kind of exceptions

I created testflight version and ran it on developement machine(m5 macbook air) with the legacy approach and it worked. But when i test it on fresh m4 macbook air it is failing to connect the usb devices. Just for the update and current status of the bug.

Sorry it did not work out in the later also. It did not run the latest binary. In both cases we need to add the temporary exception to get it work. Is there a way i can get it work wihout temporary exceptiom

Yes they inherit them because it is working for me. now i tried usb also the same way and it worked but i have a small problem please take a look at it https://developer.apple.com/forums/thread/851767

Update: we found a configuration that works without the temporary-exception entitlement. We would still like to understand whether it is the intended approach, and why the modern IOUSBHost interface API is not usable here. WHAT WORKS NOW We kept AccessoryAccess and IOUSBHostDevice for the device itself, and switched only the interfaces and pipes to the IOUSBLib plug-in API: The helper still rebuilds the AAUSBAccessory from its XPC representation and calls -openWithServiceQueue:completionHandler:. It uses the returned IOUSBHostDevice for control requests (-sendDeviceRequest:...) and for -configureWithValue:matchInterfaces:NO error:. For each IOUSBHostInterface child of the device it now calls IOCreatePlugInInterfaceForService with kIOUSBInterfaceUserClientTypeID, queries kIOUSBInterfaceInterfaceID942, and calls USBInterfaceOpen. Async completions come through CreateInterfaceAsyncEventSource on a dedicated run loop thread. Bulk and interrupt transfers use ReadPipeAsync and WritePipeAsync. Stall recovery uses ClearPipeStallBothEnds and alternate settings use SetAlternateInterface. The main app's entitlements are now only the standard ones, plus com.apple.developer.accessory-access.usb and com.apple.security.device.usb. The helper inherits the app's sandbox. With this, a USB 3 flash drive mounts in the guest and a USB 2.5GbE Ethernet adapter (Realtek 0x0BDA:0x8156) gets a DHCP address and passes traffic. We confirmed the cause twice: With the same entitlements (com.apple.security.device.usb, no temporary exception), the IOUSBHostInterface version of our helper still fails with "Failed to create IOUSBHostInterface" (kIOReturnInternalError, 0xe00002c9) for every interface. We retested this today on the same devices. A test tool running under a sandbox profile that allows only the two user-client classes application.sb grants for com.apple.security.device.usb: (deny iokit-open-user-client) (allow iokit-open-user-client (iokit-user-client-class "IOUSBDeviceUserClientV2" "IOUSBInterfaceUserClientV3")) On an interface of a device AccessoryAccess currently holds, -[IOUSBHostInterface initWithIOService:...] fails with the same error, while IOUSBLib's USBInterfaceOpen succeeds and reports the interface's pipes. Without the sandbox, both APIs open the interface. So the difference is entirely the App Sandbox rule for AppleUSBHostFrameworkInterfaceClient. FOLLOW-UP QUESTIONS Why does com.apple.security.device.usb allow IOUSBLib's interface user client but not AppleUSBHostFrameworkInterfaceClient, the client -[IOUSBHostInterface initWithIOService:...] creates? IOUSBHost is the API the documentation recommends for new code, and the one AccessoryAccess returns for the device. Is the missing sandbox rule intentional, or an oversight we should report through Feedback Assistant? Is there a supported way for a sandboxed app, or a helper inheriting its sandbox, to obtain an IOUSBHostInterface for an accessory it opened through AccessoryAccess, without a temporary-exception entitlement? For example, a planned API on AAUSBAccessory or IOUSBHostDevice that returns its interfaces. Is it supported long term to mix the IOUSBHostDevice returned by AccessoryAccess with IOUSBLib interface objects for the same device? Should we expect it to keep working, given that IOUSBLib is the older API? If IOUSBHostInterface does gain a sandbox rule later, we would prefer to move back to it. Is there anything we should watch for, such as a new entitlement name or a release in which the rule is added? Thank you. We are happy to provide the test tool, the sandbox profile, and IORegistry dumps.

Thanks. that helped me to solve the problem. now activitymonitor shows vm memory + few overhead. Thank You very much

[quote='909686022, DTS Engineer, /thread/850614?answerId=909686022#909686022'] Do you have these entitlements on the app itself, that is, the parent that spawned the helper child? [/quote] Yes I have it in the parent. i have two way of running the vms. one using virtualization framework for macos and linux vms ie in process and helper worker binary for running windows vm with hypervisor framework.

I mean both i tried enabling it in xcode when i enable microphone the other enabled automatically. when i run the helper binary with this entitlement it crashes with exit code 5. Do we really need this in helper binary. What the helper binary does in the sense it runs virtual machine in a separate process using hypervisor framework they are sandboxed and inherit secuirty and i have hypervisor and vm.networking in the entitlements. the vm records audio from mac mic. so the helper needs microphone permission technically speaking. but however withtout the microphone entitilements the recoding works. is there something i am missing to understand.

Now i have one more problme i need to add microphone cabaility to helper app when i enable the audio input the helper application does not start it exit with code 5. How can i add audio input to the helper app. thanks in advance