Passing the `--disable-sandbox` for `.prebuildCommand` parameter via Xcode

[BarredEwe]

Description

I can't pass the --disable-sandbox for .prebuildCommand parameter via Xcode.

I can pass the argument through the terminal. But in Xcode I get this result and, accordingly, an access error.

/usr/bin/sandbox-exec -p "(version 1)
(deny default)
(import \"system.sb\")
(allow file-read*)
(allow process*)
(allow file-write*
    (subpath \"/private/tmp\")
    (subpath \"/private/var/folders/zd/tempId/T\")
)
(deny file-write*
    (subpath \"/ProjectPath\")
)
(allow file-write*
    (subpath \"/DeriveData/PluginPath\")
)

Expected behavior

I can pass an argument to disable the sandbox, for example, pass other arguments in the build parameters:

//:configuration = Debug
ENABLE_USER_SCRIPT_SANDBOXING = NO

Actual behavior

I can't pass an argument to disable the sandbox via Xcode.

Steps to reproduce

1. Create a simple plugin .preBuildCommand
2. Try to write some file to the project directory
3. Run the plugin via Xcode

Swift Package Manager version/commit hash

Xcode 15.0.1

Swift & OS version (output of swift --version ; uname -a)

swift-driver version: 1.87.1 Apple Swift version 5.9 (swiftlang-5.9.0.128.108 clang-1500.0.40.1)
Target: arm64-apple-macosx14.0
Darwin mbp-mgrishutin-OZON-HVJ3M22N2Y 23.0.0 Darwin Kernel Version 23.0.0: Fri Sep 15 14:41:43 PDT 2023; root:xnu-10002.1.13~1/RELEASE_ARM64_T6000 arm64

[neonichu]

defaults write com.apple.dt.Xcode IDEPackageSupportDisablePluginExecutionSandbox -bool YES should work for this.

[nholloh]

I'm struggeling with the same issue, however disabling the sandbox like this will not work for me. Does this setting only apply to xcodeproj and xcworkspace or should it also work for Package-manager-based projects?

/usr/bin/sandbox-exec -p "(version 1)
(deny default)
(import \"system.sb\")
(allow file-read*)
(allow process*)
(allow file-write*
    (subpath \"/private/tmp\")
    (subpath \"/private/var/folders/jr/vmlbm94n0b7cv2kylsmmkkc00000gq/T\")
)
(deny file-write*
    (subpath \"/Users/holloh/Source/00_ams/99_other/KMMDemo\")
)
(allow file-write*
    (subpath \"/Users/holloh/Library/Developer/Xcode/DerivedData/KMMDemo-dgtxdkofmluaprcwetyxxffuxzck/SourcePackages/plugins/kmmdemo.output/KMPDemo/KMPGradleBuildPlugin\")
)
" /Users/holloh/Source/00_ams/99_other/KMMDemo/KMP/DemoKMP/gradlew -p /Users/holloh/Source/00_ams/99_other/KMMDemo/KMP/DemoKMP assembleDemoKMPReleaseXCFramework

Downloading https://services.gradle.org/distributions/gradle-8.0-bin.zip

Exception in thread "main" java.net.UnknownHostException: services.gradle.org
	at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:572)
	at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327)
	at java.base/java.net.Socket.connect(Socket.java:633)
	at java.base/sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:304)
	at java.base/sun.net.NetworkClient.doConnect(NetworkClient.java:178)
	at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:533)
	at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:638)
	at java.base/sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:266)
	at java.base/sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:380)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:193)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1242)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1128)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:179)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1665)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1589)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:224)
	at org.gradle.wrapper.Download.downloadInternal(Download.java:87)
	at org.gradle.wrapper.Download.download(Download.java:67)
	at org.gradle.wrapper.Install$1.call(Install.java:68)
	at org.gradle.wrapper.Install$1.call(Install.java:48)
	at org.gradle.wrapper.ExclusiveFileAccessManager.access(ExclusiveFileAccessManager.java:69)
	at org.gradle.wrapper.Install.createDist(Install.java:48)
	at org.gradle.wrapper.WrapperExecutor.execute(WrapperExecutor.java:107)
	at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:63)

[Frizlab]

Same issue here; it does not seem to work for xcodeproj project that have an SPM module that have targets using a plugin. @neonichu Is this expected behavior? Is there a workaround?