I wrote an sandbox specification file (inspired by files from /usr/share/sandbox and manuals like this) and now I can launch some app in sandbox with sandbox-exec $path_to_rules /Applications/$appname.app/Content/.... Fine.

Is there a way to enforce the rules when the app is started in regular way (Finder's "Open with...", etc)?

I thought about replacing the binary inside .app with wrapper script but it will be overwritten after app update and I will need to restore it every time.


Yes, you can change the binary, or even change the Info.plist, but like changing the binary you make will need to do this again each time the app is updated. There's no way to do this without changing the app in a way that won't be overwritten when it's updated.

You can automatically make your changes with a Launch Agent.
Save the following in ~/Library/LaunchAgents as com.yourname.youragent.plist, then run launchctl load ~/Library/LaunchAgents/com.yourname.youragent.plist.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

The above script will watch the WatchPaths for any modifications (in this case, it's watching the binary for an app) and will run cp to copy your binary to the app in /Applications.

  • I'm thinking about auto-patching installed apps. Is there a way to run my script automatically every time something in /Applications is changed? And also to forbid any app to modify itself. – Equidamoid Jul 25 '14 at 15:56
  • @Equidamoid You can use LaunchAgents; edited answer – grg Jul 25 '14 at 16:40
  • so, in your example it will run cp /Users/.../MyApp /Applications... every time MyApp binary is changed? Thanks! – Equidamoid Jul 26 '14 at 16:39
  • @Equidamoid Yes, exactly! – grg Jul 26 '14 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .