Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS's Little-Known Command-Line Sandboxing Tool (2025)

igorstechnoclub.com

Post reply on HN
Print view View original

21–30 of 96 posts

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#21

Post by bootlooped »

ImJasonH wrote: post #10

Both Claude Code and Codex use sandbox-exec with Seatbelt to sandbox execution: - https://developers.openai.com/codex/security/#os-level-sandb... - https://code.claude.com/docs/en/sandboxing

It weirds me out a bit that Claude is able to reach outside the sandbox during a session. According to the docs this is with user consent. I would feed better with a more rigid safety net, which is why I've been explicitly invoking claude with sandbox-exec.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#23

Post by blahgeek »

Although macOS do provide many little known useful tools (besides this, there’s also dtrace, pf, etc), I still run a Linux VM in my MacBook for daily work. Thing is, the effort I spend on learning these tools is almost wasteful unless I’m doing iOS or macOS development. Skills about Linux tools however, is something people considered valuable because of its wider application. I think apple is missing opportunities by not doing more about macOS Server platform.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#24

Post by selridge »

MillionOClock wrote: post #20
Someone wrote: post #7

https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.

I wonder how many major applications and tools depend on sandbox-exec today despite that depreciation, IIRC I can think of the Codex CLI and Swift Package Manager.

Claude, Firefox, safari, chrome, etc etc etc etc

Basically everyone who has to care about security on the Mac.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#26

Post by gobdovan »

xyzzy_plugh wrote: post #11

It drives me nuts that sandbox-exec has "sandbox" in the name, since it's nothing like a real sandbox, and much closer to something like a high-level seccomp, and not much to do with "App Sandboxes" which is a distinct macOS feature. IMO a real sandbox let's a program act how it wishes without impacting anything outside the sandbox. In reality many of these tools just cause hard failures when attempting to cross the…

What you're describing is a resource virtualization with transactional reconciliation instead of program isolation in the mediation sense (MAC/seccomp-style denial).

To let a program act as it wishes, ideally every security-relevant mutable resource must be virtualized instead of filtered. Plus, FS is only one of the things that should be sandboxed. You should also ideally virtualize network state at least, but ideally also process/IPC namespaces and other such systems to prevent leaks.

You need to offer a promotion step after the sandbox is over (or even during running if it's a long-running program) exposing all sandbox's state delta for you to decide selective reconciliation with the host. And you also must account for host-side drift and TOCTOU hazards during validation and application

I'm experimenting with implementing such a sandbox that works cross-system (so no kernel-level namespace primitives) and the amount necessary for late-bound policy injection, if you want user comfort, on top of policy design and synthetic environment presented to the program is hair-pulling.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#27

Post by woodruffw »

throw0101c wrote: post #5

Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?

Homebrew uses sandbox-exec during builds and installs, yeah. To my memory we’ve used it for at least 6 or 7 years, probably longer.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#29

Post by cjbarber »

cjbarber wrote: post #28

See also: https://github.com/obra/packnplay https://github.com/strongdm/leash https://github.com/lynaghk/vibe (I've been collecting different tools for sandboxing coding agents)

And from this thread I also see:

https://github.com/eugene1g/agent-safehouse via CGamesPlay

https://multitui.com/ via davidcann

Post reply on HN