4

I know the app entitlements define its scope of access to resources. I already figured out how to get an app's entitlements, using the answer to this question

For example, to see Safari's entitlements, I use the following command in Terminal:

codesign -d --entitlements :- /Applications/Safari.app/

However, I cannot find there any list of directories the app can use to write files, and no list of directories where it can't. I'm especially interested to know where does Safari store temporary mid-download files.

Please advise.

Improve this question
2
  • Safari doesn’t download the files, it calls nsurlsessiond so you don’t need to parse sandbox entitlements for this... see this for a primer
    – bmike ♦
    Commented Sep 30, 2020 at 18:59
  • But nsurlsessiond needs its write-permissions from somewhere too, isn't it? when different apps use NSURLSession objects to download things - it doesn't mean they have all the same locations to which they can write. Plus - even if it is nsurlsessiond who does the work - where can I read its file-system permissions?
    – Motti Shneor
    Commented Oct 4, 2020 at 7:26

1 Answer 1

Reset to default
3

Any sandboxed app always has full access to anywhere in its own sandbox. Safari's sandbox is

~/Library/Containers/com.apple.Safari
Improve this answer
1
  • Thanks, but that doesn't answer my question (well, very partially) I know for a fact, that Safari can write files in ~/Downloads for instance, and that it keeps partial downloads elsewhere --- not within the ~/Library/Containers/com.apple.Safari My question is a bit more general. WHERE is it written - the list of file-system locations an app can access (fore read/write/delete etc.)
    – Motti Shneor
    Commented Oct 4, 2020 at 7:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .