3 ms·

Some of these APIs are protected, and Apple keeps adding more to this list over time. For example, reading the UDID (hardware serial number) was blocked in iOS

Some of these APIs are protected, and Apple keeps adding more to this list over time. For example, reading the UDID (hardware serial number) was blocked in iOS 8 and you need an entitlement to call this API. Since the list of entitlements is covered by Apple's code signature, ordinary apps from the App Store can't use them. http://stackoverflow.com/a/27686125 http://stackoverflow.com/a/27686125 The reason they don't just do this for every API is due to the sandbox design, which makes this cumbersome.

conradev 11y ago
The use of entitlements to protect APIs is a matter of moving them out of process. This is a trend that has been going on for a long time, especially since the development of XPC in iOS 5. The trend took big steps in iOS 6, when Apple created a mechanism for remote views, and moved things like sending SMS and email out of process, in addition to the mechanism for determining what process gets what touches (backboardd). As you mentioned, MobileGestalt was another step in this direction, when Apple blocked access to the MAC address and UDID. iOS was not originally engineered with this focus of security and sandboxing in mind. For example, CVE-2015-5880 (accessing contents of screen from anywhere prior to iOS 9) existed because the screen framebuffer was needed for QuartzCore to function, and Apple didn't take the time to re-engineer how things work. The number of things you can still do from the sandbox is mind boggling, and Apple is aware of it, they just don't have the time to re-engineer everything.