The camera and microphone access issue on electron after signing the app for mac os

[rodent129]

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Issue Details

• Electron Version:
  • v4.1.3
• Operating System:
  • macOS 10.14 Mojave
• Last Known Working Electron version::

Expected Behavior

The angular desktop app with electron can access camera and microphone access on Mojave after signing the app.

Actual Behavior

The app cannot access camera and microphone on Mojave after signing the app.

To Reproduce

We are building the angular desktop app with electron for mac os.
Current app electron version is v4.1.3 and electron packager is v13.1.1. Our app needs to access camera and microphone. We know that mojave has strict access on microphone and camera, so we already use request permission to access these.
First access camera with
navigator.mediaDevices.getUserMedia({audio: false, video: true}).then(xxx).catch(this.handleError.bind(this));
If error occured, then through IPC request media access permission: systemPreferences.askForMediaAccess(mediaType).then()
Running app from command line with electron is working ok. The permission window is pop up and microphone/camera can access after allowed. Without code signing app, access camera and microphone has long dealy. After referencing this #16105, it mentioned that code signing solve the issue.
But when we are packing and signing with electron packager and osxSign, the app cannot access to microphone and camera on mojave.

Could someone help to take a look for this?

Thanks a lot.

[rodent129]

We found the issue. We missed to add the security key for accessing microphone and camera as below in our plist.

com.apple.security.device.camera

com.apple.security.device.microphone

NSMicrophoneUsageDescription
string to describe for access microphone
NSCameraUsageDescription
string to describe for access camera
CFBundleURLTypes

[smatt989]

@rodent129 how did you actually do this? I'm running into the same issue. Did you just edit the plist file:
com.apple.security.device.camera TRUE
com.apple.security.device.microphone TRUE

[mickael-menu]

Add this to your package.json:

"build": {
    "mac": {
       "hardenedRuntime": true,
       "entitlements": "entitlements.mac.plist",
       "extendInfo": {
            "NSMicrophoneUsageDescription": "Please give us access to your microphone"
        }
    }
}

The file entitlements.mac.plist should contain:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.device.microphone</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
  </dict>
</plist>

These settings are for an app that will be notarized, which requires hardened runtime.

[AleshaOleg]

For me, the issue was that electron-builder didn't read my entitlements.mac.plist from build folder as I supposed from docs (https://www.electron.build/configuration/mac). After I set up a path to those files manually, after building it and signing app crashed.

So, I googled a bit and found this article - https://medium.com/@stephen.cty/notarize-electron-app-for-macos-catalina-10-15-d994e29dfe82

Which in some point saying do not add com.apple.security.app-sandbox to mac build and added com.apple.security.cs.allow-unsigned-executable-memory.
After I removed it app built, but didn't notarize successfully. What I did is copied default entitlements from app-builder-lib for mas build and setup entitlements files for mas separately. And it worked.

Now my config looks like this:

"afterSign": "./scripts/notarize.js",
"mac": {
  "category": "public.app-category.business",
  "entitlements": "./build/entitlements.mac.plist",
  "hardenedRuntime": true,
  "gatekeeperAssess": false,
  "extendInfo": {
    "NSMicrophoneUsageDescription": "We need access to your microphone so people you talk to in a Grape Call can hear you.",
    "NSCameraUsageDescription": "Allow your conversational partners to see you in a Grape Call. You can turn off your video anytime during a call."
  },
  "target": [
    "mas",
    "dmg",
    "zip"
  ]
},
"mas": {
   "entitlements": "./build/entitlements.mas.plist",
    "entitlementsInherit": "./build/entitlements.mas.inherit.plist"
},
"dmg": {
  "sign": false
}

Hope this will help!

[dannyharding10]

@AleshaOleg and others with troubles signing/notarizing, here is a blog post that explains in detail how to get this set up. Thought it may be useful for others that stumble upon this thread https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

[aleks801]

For showing an access window for the camera you should add

<key>com.apple.security.device.camera</key>
<true/>

into entitlements.mac.plist

[ngohuytrieu]

We found the issue. We missed to add the security key for accessing microphone and camera as below in our plist.

com.apple.security.device.camera

com.apple.security.device.microphone
NSMicrophoneUsageDescription
string to describe for access microphone
NSCameraUsageDescription
string to describe for access camera
CFBundleURLTypes

@rodent129 where do you put these key and strings
NSMicrophoneUsageDescription string to describe for access microphone NSCameraUsageDescription string to describe for access camera

[ngohuytrieu]

entitlements.mac.plist

@mickael-menu where is the file entitlements.mac.plist ?