On macOS 27 the File Provider extension of our app (Secure ShellFish, an SSH client) can't connect to any host on the local network, while the containing app connects to the same host on the same Mac without problems. Local Network is enabled for the app in System Settings, but every connection from the extension fails with "Local network prohibited". It did not happen on macOS 26 and still happens on macOS 27.2 (26B123).
This is hitting end users of Secure ShellFish, not just my test setup, and it has been my number one support issue since macOS 27 was released.
I filed this as FB24999927 with a sysdiagnose. I'm posting here to find out whether others with File Provider (or other) extensions see the same, and whether there is anything on our side that should make it work.
Steps
- Install the app on a clean macOS 27 system and launch it. Choose Allow at the Local Network prompt.
- Add an SSH server on the local network (another Mac in my test) and open a terminal to it. This works.
- Open the same server in Finder (the File Provider domain under ~/Library/CloudStorage). The directory listing fails.
What happens
TN3179 says "In general, app extensions share the Local Network privilege state of their container app", so I expected the listing to load. Instead every connection from the extension to the LAN host is blocked, and the error depends on the networking API:
- CFStream: ENETDOWN (50) "Network is down"
- BSD socket
connect(): EHOSTUNREACH (65) "No route to host" - Network.framework (
NWConnection, multipath TCP): waits with pathunsatisfied (Local network prohibited)until our connect timeout, ETIMEDOUT (60)
No Local Network prompt appears. Toggling the permission, rebooting, killing the extension process and reinstalling the app don't help.
What I ruled out
- A stale extension process: freshly launched extension processes are blocked on their very first connection.
- A missing UUID cache: after installing a new build,
nehelperpopulates the cache for the app with 14 UUIDs, including both slices of the extension's executable. The extension was blocked 23 seconds later. - Shared executable UUIDs: the app and the extension have distinct Mach-O UUIDs.
- The sandbox: the extension has
com.apple.security.network.client. - A missing usage string: adding
NSLocalNetworkUsageDescriptionto the extension's Info.plist changed nothing, with no prompt and no separate entry in System Settings. - Networking in general: the extension reaches internet hosts and the Mac itself by its local name. Only other hosts on the local network are blocked.
Log
The blocked notification arrives with bundle_id: (null). UserEventAgent then maps the extension to the app by its UUID, nehelper answers that local network is allowed by preference, and the handler is called with the newly allowed state. Later connections from the same process are still blocked, so that state never takes effect for the extension.
09:19:37.575 UserEventAgent Got local network blocked notification: pid: 4297, uuid: 183484C2-8052-36AD-A81E-B02F15F875B3, bundle_id: (null)
09:19:37.575 UserEventAgent LocalNetwork: found bundle id com.appliedphasor.secure-shellfish.mac-provider by PID
09:19:37.575 ShellFish-Finder [C1.1.1 IPv6#dace0833.22 failed path (unsatisfied (Local network prohibited), interface: en0[802.11], ipv4, ipv6, uses wifi)]
09:19:37.576 UserEventAgent LocalNetwork: found bundle id com.appliedphasor.secure-shellfish by UUID 183484C2-8052-36AD-A81E-B02F15F875B3
09:19:37.597 nehelper UUID cache hit for com.appliedphasor.secure-shellfish
09:19:37.597 nehelper Local network allowed by preference for ShellFish (com.appliedphasor.secure-shellfish)
09:19:37.597 UserEventAgent App got response: 1
09:19:37.597 UserEventAgent Calling handler with newly allowed state: 1
09:19:44.795 fileproviderd populate-directory error: FP -1004 "Unable to list p5.local: Unable To Connect To P5.Local: Network Is Down."
Questions
- Is this a known change in macOS 27? FB24035385 (helper and child processes no longer inherit Local Network access on macOS 27) sounds related, and other File Provider apps report the same, for example nextcloud/desktop#10885: https://github.com/nextcloud/desktop/issues/10885
- Does an extension need anything on macOS 27 to share its container's Local Network privilege, such as an entitlement, an Info.plist key, or something the app must do first?
- If not, is there a supported workaround? The only one we see is to relay the extension's traffic through the main app over loopback, which only works while the app is running.
For these users Finder integration is completely broken, because servers on the local network (Raspberry Pi, NAS, home servers) are the most common setup among them. Any pointers are much appreciated.