Re: [Interest] OSX security – allow dialogue

Alexander Carôt Sat, 09 Oct 2021 15:38:44 -0700

Hi Nuno,

>>You will need to code sign the app with entitlements to solve this issue otherwise it will never ask you permission, it will just crash.

Thanks but I cannot confirm this – in the past 12 month (depending on whatever) I noticed that sometimes it does ask and sometimes not. E.g. the previous Qt5.15 version of my app is not code signed nor notarized either and it does ask for audio and video permissions in any case as I triple-checked today. In front of that backgroud I also reported this as a potential bug and maybe there is a solution to get rid of it - let's see.

Best

Alex

--
http://www.carot.de
Email : alexan...@carot.de
Tel.: +49 (0)177 5719797

Gesendet: Samstag, 09. Oktober 2021 um 23:16 Uhr
Von: "Nuno Santos" <nuno.san...@imaginando.pt>
An: "Alexander Carôt" <alexander_ca...@gmx.net>
Cc: "qt qt" <interest@qt-project.org>, "Volker Hilsheimer" <volker.hilshei...@qt.io>
Betreff: Re: [Interest] OSX security – allow dialogue

Alexander,

You will need to code sign the app with entitlements to solve this issue otherwise it will never ask you permission, it will just crash.

To do this, create a xml file with the following content. I’ve called it entitlements.xml:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>com.apple.security.device.audio-input</key>

<true/>

<key>com.apple.security.device.camera</key>

<true/>

</dict>

</plist>

Then you need to code sign your bundle:

codesign --options=runtime --entitlements $$PWD/entitlements.xml --deep BUNDLE_NAME.app -s \"Developer ID Application: YOUR_TEAM_NAMEΩ (YOUR_TEAM_ID)\" && \

This will prevent the app from crashing when trying to access the camera.

If you want the OS to prompt authorisation to use the camera before actually opening the camera you need to trigger that using something like this:

void CameraManager::requestCameraUsagePermission()
{
if (@available(macOS 10.14, *))
{
switch([AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeVideo])
{
case AVAuthorizationStatusAuthorized:
_isCameraUsageAllowed = true;
break;
case AVAuthorizationStatusNotDetermined:
dispatch_async(dispatch_get_main_queue(), ^{
[AVCaptureDevice requestAccessForMediaType:AVMediaTypeVideo completionHandler:^(BOOL granted)
{
if (granted)
{
setIsCameraUsageAllowed(true);
}
else
{
setIsCameraUsageAllowed(false);
}
}];
});
break;
case AVAuthorizationStatusRestricted:
_isCameraUsageAllowed = false;
break;
case AVAuthorizationStatusDenied:
_isCameraUsageAllowed = false;
}
}
else
{
_isCameraUsageAllowed = true;
}
}

You will also need to have the permissions strings declared on the Info.plist:

<key>NSCameraUsageDescription</key>
<string>This app makes use of camera during session with other peers</string>
<key>NSMicrophoneUsageDescription</key>
<string>This app makes use of microphone or audio input during sessions with other peers</string>

I would also recommend notarising your app so you don’t have warnings from the system saying that it is not secure when opening. You never have this warnings when running on the computer you are developing. Only on other machines

I hope this helps!

Best regards,

Nuno

On 9 Oct 2021, at 21:38, Volker Hilsheimer <volker.hilshei...@qt.io> wrote:

Hi Alexander,

Fascinating. I can reproduce this. Starting from Terminal doesn’t crash (no matter whether with ‘open’ or the binary inside the bundle directly), starting camera.app via Finder does. Starting the camera binary inside the camera.app bundle via Finder does not crash, it asks for permission and if rejected nothing special happens (no video, obviously, also no crash).

The multimedia/declarative-camera example however does start correctly in all cases. It doesn’t ask for microphone access, which the multimediawidgets/camera example does when launched from Terminal.

The stack trace I get with the widgets example goes to

12 com.apple.avfoundation         0x00007fff30bbe7a5 -[AVCaptureSession addInput:] + 71
13 org.qt-project.QtMultimedia    0x000000010ec99f00 AVFCameraSession::attachAudioInputDevice() + 176
14 org.qt-project.QtMultimedia    0x000000010ec9a190 AVFCameraSession::updateAudioInput() + 128 (avfcamerasession.mm:487)
15 org.qt-project.QtMultimedia    0x000000010ec97dd0 AVFCameraService::setAudioInput(QPlatformAudioInput*) + 624 (avfcameraservice.mm:146)
16 org.qt-project.QtMultimedia    0x000000010ec65c98 QMediaCaptureSession::setAudioInput(QAudioInput*) + 56 (qmediacapturesession.cpp:204)

before disappearing into com.apple.Foundation. Perhaps that helps us figure out what’s going on.

>From those observations I’d either way think that things should work as you expect them to (ie. nothing special needs to be done to trigger those permission dialogs).

Filed a JIRA ticket at

https://bugreports.qt.io/browse/QTBUG-97408

Thanks,
Volker

On 9 Oct 2021, at 22:08, Alexander Carôt <alexander_ca...@gmx.net> wrote:

P.S.: see below – in that regard I compiled the camera example (Qt6.2) and ran it via clicking on the app icon (rather than running it from the console which per se has cam access). Also here it did not ask for allowing cam access and then the app crashed. Can anyone reconstruct this ?

--
http://www.carot.de
Email : alexan...@carot.de
Tel.: +49 (0)177 5719797

Gesendet: Samstag, 09. Oktober 2021 um 11:47 Uhr
Von: "Alexander Carôt" <alexander_ca...@gmx.net>
An: "qt qt" <interest@qt-project.org>
Betreff: [Interest] OSX security – allow dialogue

Hej all,

not sure if this is a bug on my end, a bug in Qt or even a bug in OSX:

When I deploy a new release of my software (which uses audio and video capture) after installation on a user's machine it asks for permissions to access the mic and the camera. When not enabled sound capture does not work and video even crashes – when enabled all is fine. So this dialogue is really important to the user.

However, in some cases the new deployed version does not ask this question anymore and as a result the user manually has to change the security settings. Otherwise they stick to the previous version.

For some reason I discover this again after deploying with the new Qt6.2 but (as written above) I don't know if it's related.

Can anyone help in this regard ? Any hint appreciated because for almost one year I am really confused about this. Maybe there is a way to force the OS to enable this dialogue ?!

Thanks a lot in advance,
best

Alex

--
http://www.carot.de
Email : alexan...@carot.de
Tel.: +49 (0)177 5719797

_______________________________________________
Interest mailing list
Interest@qt-project.org
https://lists.qt-project.org/listinfo/interest

_______________________________________________
Interest mailing list
Interest@qt-project.org
https://lists.qt-project.org/listinfo/interest

_______________________________________________
Interest mailing list
Interest@qt-project.org
https://lists.qt-project.org/listinfo/interest

_______________________________________________
Interest mailing list
Interest@qt-project.org
https://lists.qt-project.org/listinfo/interest

Re: [Interest] OSX security – allow dialogue

Reply via email to