31–40 of 96 posts
alias sandbox-no-network='sandbox-exec -p "(version 1)(allow default)(deny network*)"'
for sh-compliant shells, including a whitespace at the end of the alias string causes the next token to also go through alias expansion. (maybe it would also be a hint to the shell for tab completion as well). This is a perfect example of when, where, and why you would want to do that.
https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.
Interesting config used a Scheme-like format. Any ideas on how that came to be?
https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.
Does anyone have any details regarding the deprecation? I wonder why Apple made this decision.
Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?
It drives me nuts that sandbox-exec has "sandbox" in the name, since it's nothing like a real sandbox, and much closer to something like a high-level seccomp, and not much to do with "App Sandboxes" which is a distinct macOS feature. IMO a real sandbox let's a program act how it wishes without impacting anything outside the sandbox. In reality many of these tools just cause hard failures when attempting to cross the…
> If macOS simply had overlay mounts in a sandbox then it would unlock so much. Compared to Linux containers (docker, systemd, bubblewrap, even unshare) macOS is a joke. You'll want to look into Homebrew (or Macports) for access to the larger world
You can spoof or disappear a mashed file. You can trigger vulnerabilities by breaking internal assumptions of a program.
https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.
Does anyone have any details regarding the deprecation? I wonder why Apple made this decision.
They can’t immediately just do away with it because a bunch of their first party apps use it (entitlements don’t cut it). It’s a weird space.
Earlier quoted context omitted.
Does anyone have any details regarding the deprecation? I wonder why Apple made this decision.
I don’t know if there are problems with this tool, but the App Sandbox is very configurable and every app store app is in one. It doesn’t make sense to maintain two different complex sandboxing solutions.
I agree that there is no sense in operating dual systems, but entitlements can’t replace SBPL yet.
https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.