macOS's Little-Known Command-Line Sandboxing Tool (2025)

Post by bdash » Sat, Feb 21, 2026, 7:08 PM UTC

m132 wrote: post #56

xyzzy_plugh wrote: post #11

It drives me nuts that sandbox-exec has "sandbox" in the name, since it's nothing like a real sandbox, and much closer to something like a high-level seccomp, and not much to do with "App Sandboxes" which is a distinct macOS feature. IMO a real sandbox let's a program act how it wishes without impacting anything outside the sandbox. In reality many of these tools just cause hard failures when attempting to cross the…

> not much to do with "App Sandboxes" which is a distinct macOS feature The App Sandbox is literally Seatbelt + Cocoa "containers". secinitd translates App Sandbox entitlements into a Seatbelt profile and that is then transferred back to your process via XPC and applied by an libsystem_secinit initializer early in the process initialization, shortly before main(). This is why App Sandbox programs will crash with `for…

  (when (entitlement "com.apple.security.files.downloads.read-only")
        (read-only-and-issue-extensions (home-subpath "/Downloads")))
  (when (entitlement "com.apple.security.files.downloads.read-write")
        (read-write-and-issue-extensions (home-subpath "/Downloads")))
  (when (or (entitlement "com.apple.security.files.downloads.read-only")
            (entitlement "com.apple.security.files.downloads.read-write"))
        (allow process-exec (home-subpath "/Downloads")))

Post by ghostclaw-cso » Sat, Feb 21, 2026, 7:10 PM UTC

Post by gobdovan » Sat, Feb 21, 2026, 7:14 PM UTC

m132 wrote: post #59

gobdovan wrote: post #26

Earlier quoted context omitted.

What you're describing is a resource virtualization with transactional reconciliation instead of program isolation in the mediation sense (MAC/seccomp-style denial). To let a program act as it wishes, ideally every security-relevant mutable resource must be virtualized instead of filtered. Plus, FS is only one of the things that should be sandboxed. You should also ideally virtualize network state at least, but ideal…

> I'm experimenting with implementing such a sandbox that works cross-system (so no kernel-level namespace primitives) and the amount necessary for late-bound policy injection, if you want user comfort, on top of policy design and synthetic environment presented to the program is hair-pulling. Curious, if this is cross-platform, is your design based on overriding the libc procedures, or otherwise injecting libraries…

Post by kyralis » Sat, Feb 21, 2026, 7:30 PM UTC

mixtureoftakes wrote: post #42

what is with the ai written articles lately? and ai designed websites? who looks at it and goes "yes, ill upvote this. more people should see it."?

Post by frizlab » Sat, Feb 21, 2026, 7:34 PM UTC

js2 wrote: post #49

selridge wrote: post #38

Earlier quoted context omitted.

There’s not that much detail. A few comments in 2019 from a DTS person indicated that Apple didn’t really anticipate people shipping on this in volume. My guess is they want to dissuade people from using it. They can’t immediately just do away with it because a bunch of their first party apps use it (entitlements don’t cut it). It’s a weird space.

> a DTS person Quinn the Eskimo, no doubt. I'm convinced he or she is the only actual human being providing developer technical support at Apple. Certainly the only one I've ever successfully communicated with. Support tickets go to robots who are incapable of providing relevant answers. Maybe Quinn is an alias with a team of humans behind it, but I don't think so. I've had him or her take forum posts to private e-ma…