Is there any application forced sandboxing feature yet?
Something users can control to forcibly stop bad behavior from certain “must have” apps. Chrome, for example, has been caught doing entire drive scans on Windows, and I’m not sure I entirely trust Zoom either. So I’d like to lock down what they can access in terms of files, paths, devices and so on and be fully confident that even if my employer demands I run some software installer provided by their “partners” that it hasn’t installed some creepy daemon and configured launchd to keep it running after I kill the app or even kill -9 the process.
Yes we can use VMs for this, but Mac laptops aren’t generally beefy machines, so that’s not an optimal solution.
There used to be sandbox_exec, but I’ve heard they removed it entirely from this version. We’re now supposed to get things from the (cr)App Store, which guarantees the app will only have entitlements that Apple approves. But vendors are abandoning the App Store in droves for many good reasons, and after recent events I don’t totally trust Apple to prevent malicious use piggybacking on top of a legit entitlement.