title: Xcode executable bundle resource not working with sandboxing, cannot write to "MODULE" file; THROTTLED
body: <p>In my Cocoa app there is a binary executable resource that is signed by me and runs from within the sandbox. However, it doesn't run successfully, and there is material in its stderr that is not there when I run this call outside of my app. The program I am running is called <code>tbl2asn</code>, provisioned by the US Government and source code is available; this program is compiled along with a bunch of others as part of a library for biological data.</p>
  
  <p>For completeness, this is the exact call I'm using,
  <code>tbl2asn -V v -a l1 -t inputfile1 -i inputfile2 -o outputfile</code></p>
  
  <p>It ultimately generates three files, the one given by <code>-o</code> and two files in the directory from which the program is run which are due to the <code>-V v</code> flag. </p>
  
  <p>I tell Xcode to write the <code>-o</code> file to a <code>NSTemporaryDirectory()</code>, where other files are written successfully with sandboxing on, but it doesn't write the ones I want when Sandboxing is on. Since the process fails the same in the app without the <code>-V v</code> (which for sure causes attempts to write files to where the resources is), it makes me think there is some attempted I/O to disallowed places.</p>
  
  <p>Outside the app, when <code>tbl2asn</code> is run, only a couple unimportant notifications are printed to stderr, but within the app, when I pass forward stderr from the <code>tbl2asn</code> call, this is what I see,</p>
  
  <pre><code>2019-02-28 05:35:47.793894-0800 tbl2asn[67411:9510814] WARNING: The Gestalt selector gestaltSystemVersion is returning 10.9.0 instead of 10.14.0. This is not a bug in Gestalt -- it is a documented limitation. Use NSProcessInfo's operatingSystemVersion property to get correct system version number.
  Call location:
  2019-02-28 05:35:47.796781-0800 tbl2asn[67411:9510814] 0   CarbonCore                          0x00007fff3a2a5464 ___Gestalt_SystemVersion_block_invoke + 112
  2019-02-28 05:35:47.796797-0800 tbl2asn[67411:9510814] 1   libdispatch.dylib                   0x000000010073a7f3 _dispatch_client_callout + 8
  2019-02-28 05:35:47.796808-0800 tbl2asn[67411:9510814] 2   libdispatch.dylib                   0x000000010073c4bb _dispatch_once_callout + 87
  2019-02-28 05:35:47.796819-0800 tbl2asn[67411:9510814] 3   CarbonCore                          0x00007fff3a246665 _Gestalt_SystemVersion + 946
  2019-02-28 05:35:47.796829-0800 tbl2asn[67411:9510814] 4   CarbonCore                          0x00007fff3a23fae8 Gestalt + 147
  2019-02-28 05:35:47.796840-0800 tbl2asn[67411:9510814] 5   tbl2asn                             0x000000010037a806 Nlm_GetOpSysString + 22
  2019-02-28 05:35:47.796850-0800 tbl2asn[67411:9510814] 6   tbl2asn                             0x0000000100002a63 Nlm_Main + 6163
  </code></pre>
  
  <p>REMOVED: <code>dtruss</code> output.</p>
  
  <hr>
  
  <p>UPDATE: I have pinpointed the problem but I don't understand what is going on.</p>
  
  <p>SYNOPSIS: Examining <code>fs_usage</code> in and outside the sandbox revealed this difference:</p>
  
  <p>In the sandbox, the opening fails and subsequent write calls do not happen to a thing called <code>toasn3.msg</code>. In the <code>fs_usage</code> output from the sandboxed run it says THROTTLED; this is absent from the non-sandboxed call, where instead it has a lot of lines like this,</p>
  
  <pre><code>22:52:23.615921  write             F=4    B=0x1000                                                                                                                                                        
                      0.000023   tbl2asn.2073266
  </code></pre>
  
  <p>where write calls are made to the <code>toasn3.msg</code> thing, here the ID is <code>tbl2asn.2073266</code></p>
  
  <p>Here is the failed sandboxed-run attempt <code>fs_usage</code>,</p>
  
  <pre><code>22:38:36.043193  stat64                 [  2]           toasn3.msg                                                                                                                                                            0.000008   tbl2asn.2070594
  22:38:36.043203  open                   [  2] (R_____)  toasn3.msg                                                                                                                                                            0.000007   tbl2asn.2070594
  22:38:36.060833    THROTTLED                                                                                                                                                                                                  0.200916   mds_stores.2069534
  22:38:36.060834  PAGE_IN_FILE      A=0x0104af5000                                                                                                                                                                             0.201197   mds_stores.2069534
  22:38:36.061164    PgIn[AT3P]      D=0x01faa58e  B=0x1000   /dev/disk1s1  /.Spotlight-V100/Store-V2/C6256897-E180-4650-85BD-78E01145E16F/reverseDirectoryStore                                                                0.000279 W mds_stores.2069534
  22:38:36.061165    PgIn[AT3P]      D=0x01fab2ed  B=0x1000   /dev/disk1s1  /.Spotlight-V100/Store-V2/C6256897-E180-4650-85BD-78E01145E16F/reverseDirectoryStore                                                                0.000224 W mds_stores.2069534
  22:38:36.061169    PgIn[AT3P]      D=0x01fa9eca  B=0x1000   /dev/disk1s1  /.Spotlight-V100/Store-V2/C6256897-E180-4650-85BD-78E01145E16F/reverseDirectoryStore                                                                0.000208 W mds_stores.2069534
  22:38:36.061187    PgIn[AT3P]      D=0x0060614d  B=0x1000   /dev/disk1s1  /.Spotlight-V100/Store-V2/C6256897-E180-4650-85BD-78E01145E16F/reverseDirectoryStore                                                                0.000211 W mds_stores.2069534
  22:38:36.091770  ioctl             F=2  [ 25] &lt;CMD=0x4004667a&gt;                                                                                                                                                                0.000003   tbl2asn.2070594
  22:38:36.091772  ioctl             F=2  [ 25] &lt;CMD=0x40487413&gt;                                                                                                                                                                0.000001   tbl2asn.2070594
  22:38:36.091791  write             F=2    B=0x25                                                                                                                                                                              0.000005   tbl2asn.2070594
  22:38:36.091794  ioctl             F=0   &lt;CMD=0x4004667a&gt;                                                                                                                                                                     0.000003   tbl2asn.2070594
  22:38:36.091798  ioctl             F=2  [ 25] &lt;CMD=0x4004667a&gt;                                                                                                                                                                0.000001   tbl2asn.2070594
  22:38:36.091799  ioctl             F=2  [ 25] &lt;CMD=0x40487413&gt;                                                                                                                                                                0.000001   tbl2asn.2070594
  22:38:36.091802  write             F=2    B=0x25                                                                                                                                                                              0.000001   tbl2asn.2070594
  22:38:36.091804  ioctl             F=0   &lt;CMD=0x4004667a&gt;                                                                                                                                                                     0.000001   tbl2asn.2070594
  22:38:36.091859  open                   [  2] (_WC_T_)  private/var/folders/8m/bqlpqcq17x1_mgjkg81s2grw0000gn/T/1D6BF273-0837-427B-BA21-ACDB6A2C514D-4072-00001FC00236C89B&gt;&gt;&gt;&gt;&gt;&gt;                                              0.000049   tbl2asn.2070594
  22:38:36.092838  close             F=3                                                                                                                                                                                        0.000010   tbl2asn.2070594
  22:38:36.094428  read              F=15   B=0x0                                                                                                                                                                               0.282789   SeqKing.2069951
  22:38:36.094450  exit                                                                                                                                                                                                         0.000059   tbl2asn.2070594
  </code></pre>
  
  <p>here is the definition of <code>toasn3.msg</code>. What is this thing?</p>
  
  <pre><code>MODULE toasn3
  $$ ORGANISM, 1
  $^   Empty, 1, SEV_WARNING
  $^   NotFound, 2, SEV_WARNING
  $^   Diff, 3, SEV_WARNING
  $$ SOURCE, 2
  $^   MultipleQualifiers, 1, SEV_WARNING
  $^   DiffQualifiers, 2, SEV_WARNING
  $^   Identical, 3, SEV_WARNING
  $^   NotFound, 4, SEV_WARNING
  $^   GeneticCode, 5, SEV_WARNING
  $^   UnwantedQualifiers, 6, SEV_WARNING
  $^   MissingOrganism, 7, SEV_WARNING
  $^   NotFoundWHole, 9, SEV_WARNING
  $^   Multiple, 10, SEV_WARNING
  $^   Diff, 11, SEV_WARNING
  $^   QualDiffValues, 12, SEV_WARNING
  $^   IllegalQual, 13, SEV_WARNING
  $^   QualUnknown, 14, SEV_INFO
  $$ TAXONOMY, 4
  $^   GeneticCode, 1, SEV_ERROR
  $$ FEATURE, 5
  $^   CannotMapDnaLocToAALoc, 1, SEV_ERROR
  $^   BadLocation, 2, SEV_WARNING
  $^   CDSNotFound, 3, SEV_WARNING
  </code></pre>