I wanted to play some games found on internet (not the Mac store) but I was afraid those could have a virus inside. As such I wanted to run them in a sandbox where they could just read files from their folder.
I have found some questions about sandbox-exec but pretty old and Apple says it is a deprecated command (though I don't care as long as it works).
$ cat myscript.sh #!/bin/bash $ cat perms.sb (version 1) (deny default) (debug all) $ sandbox-exec -f perms.sb ./myscript.sh sandbox-exec: execvp() of './myscript.sh' failed: Operation not permitted
What are the minimum perms to run a program?
debug doesn't seem to add anything useful. Note that this command works if I replace
deny default with
allow default but I can't find what
allow default allows. For instance it allows to write to a folder outside of the one from the script.
On a side note Apple says that
sandbox-exec is deprecated and we should include sandboxing in our app... this is useful for apps from the Mac store and/or our own apps but what about something else downloaded from internet?
Final thought: would there be a smart way to set perms with
chmod so that the program cannot access/write stuff from my user?