macOS 权利音频输入与麦克风

Question

对于 macOS 沙箱，有两个授权 key :

com.apple.security.device.audio-input
com.apple.security.device.microphone

我测试了两者，都允许麦克风输入。

它们之间有什么区别？

Answer 1

com.apple.security.device.microphone是沙盒权利。如果您想在沙盒应用程序中使用麦克风，则需要启用它，
com.apple.security.device.audio-input是一种强化的运行时权利。如果您想在使用强化运行时构建的应用程序中使用麦克风，则需要启用它。

如果您的应用既经过沙盒处理又经过强化，您将需要同时启用两者。

在这种情况下，沙盒和强化提供了重叠保护。

在沙盒应用程序中，如果您没有 com.apple.security.device.microphone权利，您的应用程序将无法访问麦克风。

在强化的应用程序中，如果您没有 com.apple.security.device.audio-input权利，您的应用程序将无法使用 Core Audio 访问麦克风或任何音频输入，

This很好地解释了沙箱和强化之间的关系。

We can see in Xcode 10 that the Resource Access section of the Hardened Runtime shows a great deal of overlap with the App Sandbox, while the Runtime Exceptions section has functionality unique to the hardened runtime. What's the reason for the overlap? The sandbox was designed mainly for the App Store, while the hardened runtime was designed mainly for Developer ID. I've just explained in detail how the two technologies can apply to the same app and don't depend on the distribution method, but in the near future the majority of apps will probably use at most one of the two: sandboxing for Mac App Store apps and hardening for notarized Developer ID apps. This is why duplicate entitlements exist.