3 ms·

How do you keep an application from taking an entitlement it shouldn't have (such as location or bluetooth access for fingerprinting) via code? Sandboxes can be

by kec 4y ago

How do you keep an application from taking an entitlement it shouldn't have (such as location or bluetooth access for fingerprinting) via code? Sandboxes can be enforced via entitlement checks in code, but the act of holding an entitlement is policy.

hermitdev 4y ago
Surely the entitlements are enforced via code on iOS, right? It cannot be on the honor system.
- kec 4y ago
  Using the entitlements are enforced at runtime yes, but granting them in the first place is enforced at app review time. If an app asserts an entitlement the developer can't justify it will fail review.
sitharus 4y ago
The usual way - entitlements are held in a kernel data structure, and the kernel and associated system services won't allow access to APIs when the entitlement isn't there. Try it on iOS, if you don't have the right entitlements system API calls will fail.
deleted 4y ago
[deleted]