sdlc.dev

iOS path · Living with the system · Topic 10 of 11

Sandbox, permissions and privacy manifests

Not started

Every iOS app runs in a **sandbox**. At install the system gives it a signed, read-only bundle and a private data container, and the app can't see other apps' files or most of the system. Anything beyond that, such as photos, location, contacts, the camera or the microphone, is reached through a framework that checks permission first. On top of these runtime rules, Apple requires apps to declare up front what they use, both in Info.plist and in a privacy manifest.

Why it matters: A missing purpose string crashes the app, a missing privacy manifest reason blocks the upload, and a vague prompt gets your permission denied for good.

  1. 1Sandboxed by default

    Each app sees only its own container; everything else goes through system APIs and permissions.

  2. 2Ask with a reason

    Protected resources need a purpose string in Info.plist and the person's consent, asked at the moment it makes sense.

  3. 3Declare what you use

    PrivacyInfo.xcprivacy lists the data you collect and why you call required reason APIs, including UserDefaults.

1

How it works

The explanation, with examples you can run.

The container

The bundle (YourApp.app) is signed at install and can't be modified; writing into it would break the signature and stop the app from launching. Your data lives in the separate data container (Documents, Library, tmp, covered in the persistence topic). Sharing between your own apps and extensions goes through an App Group container and a shared Keychain access group, both granted by entitlements. Files from elsewhere arrive through the document picker or the share sheet, which hand you access to the chosen item only.

Asking for permission

// Info.plist (or the target's Info tab):// NSLocationWhenInUseUsageDescription = "Shows restaurants that deliver to where you are." let manager = CLLocationManager()manager.requestWhenInUseAuthorization()        // shows the system prompt once switch manager.authorizationStatus {case .authorizedWhenInUse, .authorizedAlways: startUpdating()case .denied, .restricted: showLocationOffExplanation()   // offer a link to Settingscase .notDetermined: break                                  // still waiting@unknown default: break}

The prompt's title is generated by the system; the message is your purpose string. Without it, access fails and the app may crash. The person decides once: a denial is remembered, and asking again shows nothing. So:

  • Ask in context, when the person taps the feature that needs it, not all at launch.
  • Ask for the least you need: when-in-use location rather than always, the limited photo picker (PhotosPicker) instead of full library access.
  • Handle denial gracefully and link to Settings with UIApplication.openSettingsURLString.

Tracking people across other companies' apps and websites, or reading the advertising identifier, also needs the App Tracking Transparency prompt with its own NSUserTrackingUsageDescription.

Privacy manifests

Since 2024, apps and third-party SDKs include a PrivacyInfo.xcprivacy property list that records:

  • the types of data collected and what they are used for, which feeds the privacy label on the App Store;
  • whether data is used for tracking, and the tracking domains contacted;
  • the required reason APIs used: APIs that could be used for fingerprinting, grouped into categories such as UserDefaults, file timestamps, system boot time, disk space and active keyboards, each with an approved reason code.
<key>NSPrivacyAccessedAPITypes</key><array>  <dict>    <key>NSPrivacyAccessedAPIType</key>    <string>NSPrivacyAccessedAPICategoryUserDefaults</string>    <key>NSPrivacyAccessedAPITypeReasons</key>    <array><string>CA92.1</string></array>  <!-- access info from the app itself -->  </dict></array>

Since May 1, 2024, App Store Connect doesn't accept uploads that use required reason APIs without a declared reason. Each SDK must ship its own manifest; yours doesn't cover them. Xcode can merge all of them into a privacy report from an archive, which is worth checking before you fill in the App Store privacy questions.

2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.Your app accesses the camera but its Info.plist has no NSCameraUsageDescription. What happens?
  2. 2.The person tapped Don't Allow for photo access last week. What happens if your app asks again?
  3. 3.Your app only reads and writes its own settings with UserDefaults. What does the privacy manifest need?

0 of 3 right so far. Get all three to finish this topic.

Go deeper