I created an App and started to sandbox it. Now I did privilege separation using xpc-services. I downloaded the "SandboxedFetch" example from Apple, which shows two xpc-services like an application (application-icon). In my App the xpc-services show the "pluggin"-icon. The summary tab in the project setting for my xpc-service is not available, which means that I cannot configure the entitlements like I can do on the main app. I copied a custom made entitlements-file to the xpc-service and referenced it in the project settings. But the service is running always without privilege restrictions applied to the service.
Do I need a new certificate for the service? If my app is named "com.mycompany.app" and my service is named "com.mycompany.app.service" I cannot apply my app certificate to the service. I am somehow confused about this sandboxing stuff. Do I need a new certificate for my xpc-service? If not, how can I apply the entitlements to it?
