Hi,
I'm developing an iOS app that uses a third-party library compiled with GraalVM Native Image and packaged as a dynamic framework.
During a privacy compliance review, I found several Required Reason APIs in the compiled library. Their actual uses do not appear to fit Apple's documented approved reasons.
1. File Timestamp APIs (stat, fstat, lstat)
The runtime uses these APIs to inspect system timezone files such as /etc/localtime, primarily checking file types, symbolic links, and sizes.
However, reason C617.1 appears to cover files within the app's own containers, not system files.
2. Disk Space API (fstatvfs)
The runtime uses fstatvfs to obtain filesystem block alignment information (f_frsize) for Direct I/O, rather than checking available disk space.
This does not appear to match reason E174.1.
3. System Boot Time API (mach_absolute_time)
The runtime uses this API to implement a monotonic clock, potentially including random seed initialization.
Reason 35F9.1 covers elapsed-time measurements and timers, but does not clearly address random seeding.
Questions
- Do these uses require Required Reason API declarations? If so, which approved reasons apply?
- How should developers handle API references included in a compiled runtime that may never execute in the app?
- If no approved reason matches these uses, what is the recommended compliant approach?
The app does not use these APIs for tracking or device fingerprinting. I want to ensure the framework's Privacy Manifest accurately reflects its actual behavior rather than declaring unsupported reasons.
Any guidance would be greatly appreciated.
Thank you!