6

Is it possible to do something like the concept of sandboxing (like all apps on iOS have its own system software resources) for all existing applications (so - not while designing an own new application) on OSX (Lion/ML/Maverics) just copying required frameworks, libraries, binaries (/usr, /etc, /Library, etc.) and than using chroot for the process when start?

  • I guess creating separate user is not what you looking for or creating new partition with a copy of os ? – Ruskes Sep 22 '13 at 14:52
  • nope, I would like to have like a container inside an OS, so the kernel is one but there many executions environments with libraries proces namespaces etc. one for each running application/process. Thanks for asking for details – static Sep 22 '13 at 15:25
  • See for a similar unanswered question here: apple.stackexchange.com/q/86516/14319 – nalply Oct 15 '13 at 10:18
  • 3
    there is no answer there, only your recursive-link to here back again – static Oct 15 '13 at 12:17
  • 1
    I have used sandbox-exec to run a prebuilt program in an application sandbox that I created myself. This is not the same as the chroot “jail” approach you mentioned, but it is the core of the sandboxing required by the iOS and OS X app stores. Creating the sandbox profile is a non-trivial task and I do not know of any guides for it, but it may be something worth investigating. – Chris Johnsen Oct 16 '13 at 4:12
2

Of course this is possible - iOS sandboxes all applications by default and runs on the same Darwin core as OS X. Apple hasn't chosen to implement this on OS X, so you would have a lot of engineering work to bolt this extra security on top of OS X. In the short run, it might be easier to virtualize the OS if you only need to sandbox one or two applications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .