iOS Internals · Inside iOS · Lesson 3 of 5

The Sandbox & Entitlements

Look inside an app's container and the signed permissions that open extra doors.

Every app in its own box

You met the sandbox in Mobile Fundamentals. Here's how it looks on an iPhone specifically.

Every third-party app, meaning any app not made by Apple, is sandboxed. When an app is installed, iOS gives it its own container, a private home folder with a random name that's different on every iPhone. The app keeps everything there: its databases, downloaded files, settings and caches. A hiking app might keep a map database, a folder of trail photos and a settings file. When you delete the app, its container goes with it.

Apps also run as an ordinary, low-privilege user that iOS calls mobile, not as an all-powerful administrator. Even if a bug lets an attacker take over an app, they're stuck inside that app's box with that app's limited rights.

The sandbox does more than lock folders. It also limits which parts of the system an app can talk to. If an app needs anything beyond its own files, it has to use a service that iOS deliberately offers, and iOS decides what to hand over. For private data like photos, contacts or location, that usually means you decide, through a permission prompt or a picker.

Here's what that means day to day. A free flashlight app can't open your messages, read your banking app's data or look at your photos on its own. The files are on the same phone, but the app has no path to them.

On the simulated phone, you're looking through TrailSnap's eyes. Try opening each folder, and watch what happens with the Photo Library.

Entitlements and safe sharing

Some features need more than a permission prompt. Before an app can use iCloud, Apple Pay, push notifications or Apple Health data, its developer has to switch on that capability in their Apple developer account. The result is an entitlement, a special permission written into the app and covered by its code signature. Apple restricts some entitlements so that developers have to request them and explain why.

Because entitlements are part of the signature, nobody can add one after the app is built. If someone edited an app to give it the Apple Pay entitlement, the signature would break and iOS wouldn't run it.

An entitlement isn't the same as your permission. The Health entitlement only means the app is allowed to ask. You still choose what health data, if any, it can read.

Since apps can't reach into each other's containers, iOS offers safe ways to share:

• The share sheet, the panel that appears when you tap the Share button. You pick the app and the content, so one app hands over exactly one photo or link and nothing more.
• Pickers, such as the photo picker and the Files picker. The system shows the picker, not the app, and the app receives only the items you select. An app using the photo picker doesn't need permission to see your whole library.
• App groups. Apps and extensions from the same developer account can share a container, settings and keychain items (the secure store where apps keep logins and keys). A to-do app and its Home Screen widget often use one so they show the same list. Apple keeps each group's ID unique, so another developer's app can't join it.

Each route keeps you, or the developer's own signed setup, in control of what crosses the walls.