5

I have an application installed in the ~/Applications folder. I've been using it for years with no problems. But after a recent update this application started giving me warnings that it should be installed in the main /Applications folder. But still it is working just fine, and I see no reasons to move it out from where it is now (aside from this annoying warning).

So I asked the application's support team, why do they want me to have their application installed exactly in /Applications, and here's the answer they gave me:

In order to be fully sandboxed the application must be installed into the /Applications folder

Is it really so? Mac OS sandboxes only applications installed in the /Applications? Is it stated somewhere in Apple's documentation? I could only find this article (the section about launching helpers).

And additional question: does it mean that ~/Applications (or any other) folder is "less secure" then for installing applications?

[Update]

I've got another answer from support: now they're saying that it's sandboxing and access to code signature verification API what requires them to have their application installed exactly at /Applications. I've posted a Stack Overflow question about that.

7

No, it is not really so. Being or not being stored in /Applications is not the determining factor in deciding whether or not an app is sandboxed.

No, other folders are not "less secure" than /Applications.

You haven't described which application in particular you're dealing with, but I would guess that you're running into a specific limitation on sandboxed applications - namely helpers:

An application can include a helper that is run in background using LaunchService - i.e. it runs even though you haven't started the main application.

However, a sandboxed application can only automatically start a helper if the application is stored in /Applications!

Note that there are other requirements that must be fulfilled also, but this is the one with relevance to sandboxing and the /Applications folder. The other requirements are for example that the helper must be signed (similar to the main application) and that the user must have manually started the helper before it can be automatically started.

You can read about macOS sandboxing in more detail here:

https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .