3

I'm writing a plugin for a macOS application. My code uses OpenCV and my build process links to the OpenCV dylibs.

When I build my code as part of a test application, everything runs fine. But when I build my code as a plugin, the host application fails to load the plugin with this error:

Error loading /Library/.../MyPlugin.plugin/Contents/MacOS/MyPlugin:
 dlopen(/Library/.../MyPlugin.plugin/Contents/MacOS/MyPlugin, 0x0106): dependent dylib '/usr/local/opt/opencv@3/lib/libopencv_calib3d.3.4.dylib' not found for '/Library/.../MyPlugin.plugin/Contents/MacOS/MyPlugin'.
file system sandbox blocked open("/usr/local/opt/opencv@3/lib/libopencv_calib3d.3.4.dylib", O_RDONLY)

From what I understand, my plugin runs in the process of the host application, and the host application is sandboxed (unlike my test application), so the error kindof makes sense. But I don't know what's the best way to fix it.

There are three possible solutions that I can think of:

  1. Sandboxed applications (and the plugins running inside of them) never load dylibs. If I want to use OpenCV in my plugin, I need to build it statically inside my plugin's binary.
  2. Sandboxed applications (and the plugins running inside of them) only load dylibs from specific system locations, and on my system OpenCV is not in such a blessed location. If I want my plugin to load the OpenCV dylibs, I need to put them somewhere else than /usr/local/opt (which is where brew install put them for me). What would be a correct location for these dylibs?
  3. Plugins are allowed to do things that the host application can't (like load dylibs), and this is achieved with some entitlements config voodoo that I'm not aware of. What would that be?

My guess is that #3 is wrong, and #1 is likely, but I'm hoping maybe #2 is right. Anyone has experience with the intersection of plugins, sandboxed applications, and dylibs?

user18184
  • 488
  • 5
  • 14

1 Answers1

2

I'm able to get it to work with the entitlements config.

Profile.entitlements:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <false/>
</dict>
</plist>

https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_app-sandbox

So far, I've been unable to dlopen with the sandbox enabled.

Daco Harkes
  • 296
  • 3
  • 13