I wanted to play some games found on internet (not the Mac store) but I was afraid those could have a virus inside. As such I wanted to run them in a sandbox where they could just read files from their folder.

I have found some questions about sandbox-exec but pretty old and Apple says it is a deprecated command (though I don't care as long as it works).

$ cat myscript.sh

$ cat perms.sb 
(version 1)
(deny default)
(debug all)

$ sandbox-exec -f perms.sb ./myscript.sh 
sandbox-exec: execvp() of './myscript.sh' failed: Operation not permitted

What are the minimum perms to run a program?

debug doesn't seem to add anything useful. Note that this command works if I replace deny default with allow default but I can't find what allow default allows. For instance it allows to write to a folder outside of the one from the script.

On a side note Apple says that sandbox-exec is deprecated and we should include sandboxing in our app... this is useful for apps from the Mac store and/or our own apps but what about something else downloaded from internet?

Final thought: would there be a smart way to set perms with chmod so that the program cannot access/write stuff from my user?

  • I also interested in the answer. Especially how I can limit the application's network access? Like it cannot to call any internal (LAN) resources, but can access to the Internet. – Vagif Feb 4 at 19:43

You must log in to answer this question.

Browse other questions tagged .