Log error when accessing the apple menu in a Sandboxed macOS App

Question

I'm running the just-released macOS 10.12.2, Xcode 8.2, Swift 3.

I have a strange error that comes up in all my sandboxed macOS apps. When I run the apps from Xcode and click on the Apple Menu (top left), the following error logs to the console in Xcode,

2016-12-13 19:30:55.867046 Project-X[3430:411160] [User Defaults] Failed to read values in CFPrefsPlistSource<0x6100000e3f00> (Domain: com.apple.PowerManagement, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null)): accessing preferences outside an application's container requires user-preference-read or file-read-data sandbox access, detaching from cfprefsd

If I create a build, save it to my Mac as a local app and run it from there, I see the same error as above listed in the macOS console, in addition to this error listed as a FAULT under the cfprefsd process:

rejecting read of { com.apple.PowerManagement, kCFPreferencesAnyUser, kCFPreferencesCurrentHost, no container, managed: 0 } from process 3384 because accessing preferences outside an application's container requires user-preference-read or file-read-data sandbox access

..and this under the kernel process:

SandboxViolation: Project-X(3384) deny(1) file-read-data
/Library/Preferences/com.apple.PowerManagement.plist

If I create a build without sandboxing, the error doesn't show up anywhere.

My entitlement settings are just these two:

• App Sandbox
• com.apple.security.files.user-selected.read-write

I had the same issue in 10.12.1 and thought it might be resolved in 10.12.2, but it persists. It's strangely specific, because it only presents if I click on the Apple Menu when the app is running.

Thanks very much for any insights!!

Answer 1

If the error persists, you may use a temporary exeption entitlement key to access the plist in question.

<key>com.apple.security.temporary-exception.files.absolute-path.read-only</key>
<array>
        <string>/Library/Preferences/com.apple.PowerManagement.plist</string>
</array>