I'm trying to run a potentially untrusted application without the following permissions, through the sandbox-exec command:

  1. file write (to avoid corruption/injection of files)
  2. network (to avoid communicate outside of my network)
  3. process creation (to avoid forks)
  4. access to system data (to avoid system corruption)

Let's suppose I need to run my application MyApp. I know it's possible to create a profile myprofile.sb such as the following one, but I'm not sure everything is included.

(version 1)
(allow default)
# bullet point #1
(deny file-write*)
(deny file-write-data)
# bullet point #2
(deny network*)
# bullet point #3
(deny process-fork)
(deny job-creation)
(deny process-exec)
# bullet point #4
(deny sysctl-write)
# logging every action possible
(trace "/tmp/myapp_output.sb")
(debug all)

At this point, I run the following command to run MyApp safely:

sandbox-exec -f ./myprofile.sb MyApp

If I run sample commands (e.g. ping google.it or touch /tmp/file.txt), the commands are executed correctly. Why? Am I missing something?


I know it's an old question, but maybe someone finds the answer useful.

The trace operation generates rules in the given output file.

These rules are for operations that would have been denied. (source: Apple Sandbox Guide)

Which means: the operations are not denied by the deny rules if the trace operator is in the profile file.

  • The link is broken. Could you update it?
    – auino
    Oct 1 '17 at 16:22
  • Works from here. Unfortunately I can't find another copy of the document on the web, so this is the only link I can provide.
    – peterfoldi
    Oct 2 '17 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .