Is it possible to do something like the concept of sandboxing (like all apps on iOS have its own system software resources) for all existing applications (so - not while designing an own new application) on OSX (Lion/ML/Maverics) just copying required frameworks, libraries, binaries (/usr, /etc, /Library, etc.) and than using chroot for the process when start?
-
I guess creating separate user is not what you looking for or creating new partition with a copy of os ?– RuskesCommented Sep 22, 2013 at 14:52
-
nope, I would like to have like a container inside an OS, so the kernel is one but there many executions environments with libraries proces namespaces etc. one for each running application/process. Thanks for asking for details– staticCommented Sep 22, 2013 at 15:25
-
See for a similar unanswered question here: apple.stackexchange.com/q/86516/14319– nalplyCommented Oct 15, 2013 at 10:18
-
3there is no answer there, only your recursive-link to here back again– staticCommented Oct 15, 2013 at 12:17
-
2I have used sandbox-exec to run a prebuilt program in an application sandbox that I created myself. This is not the same as the chroot “jail” approach you mentioned, but it is the core of the sandboxing required by the iOS and OS X app stores. Creating the sandbox profile is a non-trivial task and I do not know of any guides for it, but it may be something worth investigating.– Chris JohnsenCommented Oct 16, 2013 at 4:12
|
Show 2 more comments
1 Answer
Of course this is possible - iOS sandboxes all applications by default and runs on the same Darwin core as OS X. Apple hasn't chosen to implement this on OS X, so you would have a lot of engineering work to bolt this extra security on top of OS X. In the short run, it might be easier to virtualize the OS if you only need to sandbox one or two applications.