沙箱化macOS Electron应用无法访问Photos库问题求助

我有一个基于Electron开发的macOS应用，此前通过Developer ID分发多年，可正常访问系统Photos库，且Info.plist中已配置NSPhotoLibraryUsageDescription键。近期尝试发布至Mac App Store，开启沙箱后，应用访问Photos库时出现XPC错误：

PHAuthorizationStatus: Authorized
CoreData: XPC: sendMessage: failed #0
CoreData: XPC: Unable to sendMessage: to server
...
CoreData: XPC: sendMessage: failed #7
CoreData: XPC: Unable to connect to server with options {
    NSPersistentHistoryTrackingKey = 1;
    NSXPCStoreServerEndpointFactory = "<PLXPCPhotoLibraryStoreEndpointFactory: 0x7fc67e8af370>";
    skipModelCheck = 1;
}
CoreData: XPC: Unable to load metadata: Error Domain=NSCocoaErrorDomain Code=134060 "A Core Data error occurred." UserInfo={Problem=Unable to send to server; failed after 8 attempts.}
CoreData: fault: Unable to create token NSXPCConnection.  NSXPCStoreServerEndpointFactory 0x7fc67e8af370 -newEndpoint returned nil
CoreData: error: Failed to create NSXPCConnection

应用可检测到PHAuthorizationStatus为Authorized，但无法通过PhotoKit获取照片。查看sandboxd日志发现：

Sandbox: Picture Keeper(32625) deny(1) mach-lookup com.apple.photos.service
Violation:       deny(1) mach-lookup com.apple.photos.service
Process:         Picture Keeper [32625]
Path:            /Applications/Picture Keeper.app/Contents/MacOS/Picture Keeper
Load Address:    0x103bd3000
Identifier:      com.simplifieditproducts.picturekeepermas
Version:         4575 (4.5.75)
Code Type:       x86_64 (Native)
Parent Process:  Picture Keeper [1]
Responsible:    /Applications/Picture Keeper.app/Contents/MacOS/Picture Keeper
User ID:         501

Date/Time:       2024-08-26 16:16:14.645 EDT
OS Version:      macOS 14.5 (23F79)
Release Type:    User
Report Version:  8

MetaData: {"process_path":["Users","Kevin","Projects","Electron","picturekeeper-electron","dist","picturekeeper","mas-dev","Picture Keeper.app","Contents","MacOS","Picture Keeper"],"apple-internal":false,"primary-filter":"global-name","policy-description":"Sandbox","flags":5,"platform-policy":false,"build":"macOS 14.5 (23F79)","process-path":"\/Applications\/Picture Keeper.app\/Contents\/MacOS\/Picture Keeper","responsible-process-path":"\/Applications\/Picture Keeper.app\/Contents\/MacOS\/Picture Keeper","primary-filter-value":"com.apple.photos.service","platform_binary":"no","responsible-process-signing-id":"com.simplifieditproducts.picturekeepermas","hardware":"Mac","target":"com.apple.photos.service","action":"deny","mach_namespace":1,"checker-pid":1,"container":"\/Users\/Kevin\/Library\/Containers\/com.simplifieditproducts.picturekeepermas\/Data","binary-in-trust-cache":false,"team-id":"LU744924UY","process":"Picture Keeper","global-name":"com.apple.photos.service","platform-binary":false,"pid":32625,"summary":"deny(1) mach-lookup com.apple.photos.service","checker":"launchd","responsible-process-team-id":"xxxxx","operation":"mach-lookup","normalized_target":["com.apple.photos.service"],"errno":1,"uid":501,"profile-flags":0,"profile-in-collection":false,"sandbox_checker":"launchd","signing-id":"com.simplifieditproducts.picturekeepermas","release-type":"User"}

已配置Photos库相关权限：

codesign -d --entitlements - /Applications/Picture\ Keeper.app/Contents/MacOS/Picture\ Keeper

[Dict]
    [Key] com.apple.application-identifier
    [Value]
        [String] xxxx.com.simplifieditproducts.picturekeepermas
    [Key] com.apple.developer.team-identifier
    [Value]
        [String] xxxx
    [Key] com.apple.security.app-sandbox
    [Value]
        [Bool] true
    [Key] com.apple.security.application-groups
    [Value]
        [Array]
            [String] xxxx.com.simplifieditproducts.picturekeepermas
    [Key] com.apple.security.assets.movies.read-only
    [Value]
        [Bool] true
    [Key] com.apple.security.assets.music.read-only
    [Value]
        [Bool] true
    [Key] com.apple.security.assets.pictures.read-write
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.allow-dyld-environment-variables
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.allow-jit
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.allow-unsigned-executable-memory
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.disable-executable-page-protection
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.disable-library-validation
    [Value]
        [Bool] true
    [Key] com.apple.security.device.usb
    [Value]
        [Bool] true
    [Key] com.apple.security.files.bookmarks.app-scope
    [Value]
        [Bool] true
    [Key] com.apple.security.files.bookmarks.document-scope
    [Value]
        [Bool] true
    [Key] com.apple.security.files.downloads.read-only
    [Value]
        [Bool] true
    [Key] com.apple.security.files.user-selected.read-write
    [Value]
        [Bool] true
    [Key] com.apple.security.network.client
    [Value]
        [Bool] true
    [Key] com.apple.security.network.server
    [Value]
        [Bool] true
    [Key] com.apple.security.personal-information.location
    [Value]
        [Bool] true
    [Key] com.apple.security.personal-information.photos-library
    [Value]
        [Bool] true

注：Photos库相关代码已编译为.node文件（dylib），会在运行时被主可执行文件加载。请问我遗漏了什么配置？

从sandboxd日志的deny(1) mach-lookup com.apple.photos.service可以明确，沙箱阻止了应用向com.apple.photos.service发起Mach查找请求，这是访问Photos库XPC服务的必要权限。需要在应用的授权文件（entitlements）中添加以下权限：

<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
<array>
    <string>com.apple.photos.service</string>
</array>

额外注意事项：

• 该权限必须添加到主应用的授权文件中，而非仅.node模块的配置，因为主可执行文件是沙箱管控的主体进程。
• 添加权限后需重新签名应用，确保配置生效。
• 提交Mac App Store时，需准备好说明应用访问Photos库的核心用途，以便通过苹果对临时权限的审核。

内容的提问来源于stack exchange，提问作者Hao Xi