title: Sandboxing Application With Command-Line Tool
body: <p>I'm a bit confused about sandboxing an application that uses a command-line tool (<strong>ffmpeg</strong>).  I won't mention his name, but I read at least two topics at Apple's <strong>Developer Forums</strong> where an Apple person suggests that the application requires the <strong>com.apple.security.inherit</strong> entitlement.  <a href="https://stackoverflow.com/questions/11821632/mac-os-app-sandbox-with-command-line-tool/12120302#12120302">This topic</a> here also suggests that you need com.apple.security.inherit.  Do I need it if I use ffmpeg through <strong>NSTask</strong>?  My application crashes as long as this entitlement stays.  If I remove it, the application starts up.  If I take a close look at what Apple person says, the com.apple.security.inherit entitlement may be required if embedded tools are run directly from the application.  It doesn't sound like that count ones through NSTask.</p>
  
  <p>Meanwhile, <a href="https://stackoverflow.com/questions/11230168/submit-an-osx-app-with-helper-app-in-its-bundle">this topic</a> here suggets that I need to <strong>codesign</strong> the command-line tool inside the package.  In this regard, I see consistency that I need to codesign the command-line tool with the entitlement file.  But I'm not sure.</p>
  
  <p>Life has become very confusing these days.</p>
  
  <p>Thank you for your confirmation.</p>