[GH-ISSUE #477] [Feature request] 3 ideas to improve limitations #434

New issue

Closed

opened 2026-03-03 15:33:37 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 15:33:37 +03:00

Owner

Originally created by @user919722 on GitHub (Apr 27, 2025).
Original GitHub issue: https://github.com/LiveContainer/LiveContainer/issues/477

Hey,

I just wanted to brainstorm some ideas for the currently listed limitations in the readme.md. I don‘t know whether they are possible, feasible, or just require way too much effort, but I still wanted to tell you anyway:

App Permissions are globally applied.

Maybe it‘s possible to inject a global tweak into guest apps (similar to tweakloader.dylib) that intercepts all calls of the guest apps asking the system what permission it has and prompts the user what to respond.
i.e., the guest apps asks "Hey can I access the camera?" and before the system gets this question, a LC tweak intercepts and asks the user whether to respond "yes" or "no".
If LC already has camera permissions, and the user responds "no" in the popup, the guest apps asks would technically have access to the camera, but should never try it, as it got responded no.
yeah this would probably only work for some apps (if at all) but I believe the idea is interesting.

Guest app containers are not sandboxed. This means one guest app can access other guest apps' data.

This could either get solved by another injected tweak, that verifies every data access request is inside the correct data container, returning an error otherwise. Or, you could encrypt all data inside of apps data containers and decrypt it when an app is launched. (this would have the disadvantage of preventing easy file access from the files app).

App extensions aren't supported. they cannot be registered because: LiveContainer is sandboxed, SpringBoard doesn't know what apps are installed in LiveContainer, and they take up App ID.

If the installed LC ipa had an app extension, guest apps could access it.
I suggest an option inside of an app‘s settings to select app extensions to export and add to the locally installed LC IPA (LC1 or LC2). Then, install it in sidestore. guest apps could then access that app extension, I believe, as it is installed on device. the app extension should be ignored by other apps.
This wouldn‘t really work for things like widgets, but maybe for some other app extensions which are only required while the app is running.

You‘re not at all obligated to implement any of this, just wanted to present some (probably too simplified) ideas.

Thanks!

Originally created by @user919722 on GitHub (Apr 27, 2025). Original GitHub issue: https://github.com/LiveContainer/LiveContainer/issues/477 Hey, I just wanted to brainstorm some ideas for the currently listed limitations in the readme.md. I don‘t know whether they are possible, feasible, or just require way too much effort, but I still wanted to tell you anyway: > App Permissions are globally applied. Maybe it‘s possible to inject a global tweak into guest apps (similar to tweakloader.dylib) that intercepts all calls of the guest apps asking the system what permission it has and prompts the user what to respond. i.e., the guest apps asks "Hey can I access the camera?" and before the system gets this question, a LC tweak intercepts and asks the user whether to respond "yes" or "no". If LC already has camera permissions, and the user responds "no" in the popup, the guest apps asks would technically have access to the camera, but should never try it, as it got responded no. yeah this would probably only work for some apps (if at all) but I believe the idea is interesting. > Guest app containers are not sandboxed. This means one guest app can access other guest apps' data. This could either get solved by another injected tweak, that verifies every data access request is inside the correct data container, returning an error otherwise. Or, you could encrypt all data inside of apps data containers and decrypt it when an app is launched. (this would have the disadvantage of preventing easy file access from the files app). > App extensions aren't supported. they cannot be registered because: LiveContainer is sandboxed, SpringBoard doesn't know what apps are installed in LiveContainer, and they take up App ID. If the installed LC ipa had an app extension, guest apps could access it. I suggest an option inside of an app‘s settings to select app extensions to export and add to the locally installed LC IPA (LC1 or LC2). Then, install it in sidestore. guest apps could then access that app extension, I believe, as it is installed on device. the app extension should be ignored by other apps. This wouldn‘t really work for things like widgets, but maybe for some other app extensions which are only required while the app is running. You‘re not at all obligated to implement any of this, just wanted to present some (probably too simplified) ideas. Thanks!

kerem closed this issue

2026-03-03 15:33:37 +03:00

kerem commented

2026-03-03 15:33:38 +03:00

Author

Owner

@hugeBlack commented on GitHub (Apr 30, 2025):

App Permissions are globally applied.
Maybe it‘s possible to inject a global tweak into guest apps

App can directly send XPC calls to the rest of the iOS, circumventing any tweak you injected.

Guest app containers are not sandboxed.
This could either get solved by another injected tweak

Again, guest apps can access files with system calls, which are directly handled by iOS, circumventing any tweak you injected.

If the installed LC ipa had an app extension, guest apps could access it.

Yes, that maybe true. You can customize LC with the extension you want. However it is not guaranteed to work due to many causes like app groups. Thus it will not be a feature of LiveContainer.

@hugeBlack commented on GitHub (Apr 30, 2025): > App Permissions are globally applied. > Maybe it‘s possible to inject a global tweak into guest apps App can directly send XPC calls to the rest of the iOS, circumventing any tweak you injected. >Guest app containers are not sandboxed. >This could either get solved by another injected tweak Again, guest apps can access files with system calls, which are directly handled by iOS, circumventing any tweak you injected. > If the installed LC ipa had an app extension, guest apps could access it. Yes, that maybe true. You can customize LC with the extension you want. However it is not guaranteed to work due to many causes like app groups. Thus it will not be a feature of LiveContainer.