Apple iOS Security Guide

Further protection is provided by iOS using ARM’s Execute Never (XN) feature, which
marks memory pages as non-executable. Memory pages marked as both writable and
executable can be used only by apps under tightly controlled conditions: The kernel
checks for the presence of the Apple-only dynamic code-signing entitlement. Even
then, only a single mmap call can be made to request an executable and writable page,
which is given a randomized address. Safari uses this functionality for its JavaScript
JIT compiler.
Extensions
iOS allows apps to provide functionality to other apps by providing extensions.
Extensions are special-purpose signed executable binaries, packaged within an app.
The system automatically detects extensions at install time and makes them available
to other apps using a matching system.
A system area that supports extensions is called an extension point. Each extension
point provides APIs and enforces policies for that area. The system determines which
extensions are available based on extension point–specific matching rules. The system
automatically launches extension processes as needed and manages their lifetime.
Entitlements can be used to restrict extension availability to particular system
applications. For example, a Today view widget appears only in Notification Center, and
a sharing extension is available only from the Sharing pane. The extension points are
Today widgets, Share, Custom actions, Photo Editing, Document Provider, and Custom
Keyboard.
Extensions run in their own address space. Communication between the extension and
the app from which it was activated uses interprocess communications mediated by
the system framework. They do not have access to each other’s files or memory spaces.
Extensions are designed to be isolated from each other, from their containing apps, and
from the apps that use them. They are sandboxed like any other third-party app and
have a container separate from the containing app’s container. However, they share the
same access to privacy controls as the container app. So if a user grants Contacts access
to an app, this grant will be extended to the extensions that are embedded within the
app, but not to the extensions activated by the app.
Custom keyboards are a special type of extensions since they are enabled by the user
for the entire system. Once enabled, the extension will be used for any text field except
the passcode input and any secure text view. For privacy reasons, custom keyboards run
by default in a very restrictive sandbox that blocks access to the network, to services
that perform network operations on behalf of a process, and to APIs that would allow
the extension to exfiltrate typing data. Developers of custom keyboards can request that
their extension have Open Access, which will let the system run the extension in the
default sandbox after getting consent from the user.
For devices enrolled in mobile device management, document and keyboard extensions
obey Managed Open In rules. For example, the MDM server can prevent a user from
exporting a document from a managed app to an unmanaged Document Provider, or
using an unmanaged keyboard with a managed app. Additionally, app developers can
prevent the use of third-party keyboard extensions within their app.
iOS Security—White Paper | October 2014 18