Skip to main content

Questions tagged [sandbox]

a security mechanism that separates running programs from each other so that untested, or untrusted programs won't inject malicious or bad code.

Filter by
Sorted by
Tagged with
2 votes
1 answer
81 views

Is launchd confined by SIP or AMFI?

Given that signature checks for kernel extensions and executables are both carried out in userspace, this tells me that SIP and the sandbox aren't running when launchd is still the only process ...
Melab's user avatar
  • 1,019
0 votes
0 answers
17 views

Run application in sandbox mode [duplicate]

I have installed an application in /Applications/. I want this application to be run in sandbox mode. I can do this manually with sandbox-exec but i don't want to start this application through ...
Bob5421's user avatar
  • 141
0 votes
0 answers
42 views

Sandbox: Testing in app purchase issue (no products retrieved from app store connect)

All of a sudden, I am no longer able to test in app purchases on testflight builds. try await Product.products(for: [productID]) returns an empty array. Production (app in app store) functions just ...
Roselinn Hoareau's user avatar
1 vote
1 answer
83 views

App and Terminal Isolation / Sandboxing

Not often I need to do something very unique and specific on my m1 (apple silicon) macbook air. Something like: I'll be interested in video game emulation, and need very specific controller support, ...
ThomasReggi's user avatar
0 votes
0 answers
94 views

Run Brave Browser in a sandbox/VM on an M2-Mac running Sonoma 14.3?

I need to run Brave on my Mac Sonoma 14.3 (M2 Mac). Unfortunately, it is a managed device and I cannot install Brave directly. I may, anyhow, virtualise it. Installing a full-fledged OS in a Parallels-...
Xenonite's user avatar
  • 305
5 votes
2 answers
2k views

Sandbox: Python deny(1) file-read-data

In my XCode project, I have a Python script I'm running as one of my build phases. However, it's failing to open a file with the error: Sandbox: Python(22805) deny(1) file-read-data <file_name> ...
Daniel Walker's user avatar
0 votes
2 answers
213 views

How to submit a macOS app to app Store without sandboxed?

I like to know if there is a guideline or some special way to submit a macOS app to app store without having sandbox, let say you have an app that you need to remove sandbox to this app works, is ...
bulletproof software engineer's user avatar
0 votes
0 answers
885 views

How do I fix the "Cannot open the specified file" error with hyperlinks in Excel for Mac?

Since 2016, Microsoft Excel has run in an App Sandbox on macOS. This means that a HYPERLINK function which points to a local path, like HYPERLINK("/Users/me/Desktop/example.pdf"), won't work....
sjy's user avatar
  • 404
1 vote
0 answers
67 views

When relocating a home folder to another Volume, how do you resolve Sandbox errors for the new root .TemporaryItems folder?

Summary: I migrated my user data to a new APFS volume to mitigate upgrade issues with Ventura, but I am now experiencing high CPU usage with syncdefaultsd and secd due to permission issues. I need ...
ylluminate's user avatar
  • 5,451
0 votes
1 answer
2k views

MS Word does not have permission to open Word files after Ventura 13.3 update

I've recently updated my Mac to Ventura 13.3. Since then, I'm experiencing major problem with opening Word files from Finder. Some files can be opened without a problem, some just can't. To be honest, ...
Filip Uhřík's user avatar
0 votes
0 answers
430 views

Installing Adobe After Effects without the administrator rights

I'd like to get a one year license for After Effects and start learning it but in the past I've installed the trial and it was requiring an administrator password. It then added all kind of processes ...
Rad'Val's user avatar
  • 595
0 votes
1 answer
475 views

Mac OS “sandbox” on Mac OS

I need to test some signing/notarization issues with Gatekeeper and I need a completely “new” and “fresh” system for that so that I can test the app like a completely new user. Is there an easier way ...
supsayan's user avatar
0 votes
0 answers
40 views

Things3 Apple Script sandbox error

I'm using a very simple macOS script to add todo's from my Things3 in Fantastical. The reason I'm doing this is that I want more control over what is being added to the calendar event. You can add ...
GeistInTheBASH's user avatar
0 votes
0 answers
30 views

Running program in an environment w/ altered folders

I am trying to run a legacy program (not mine) and trying to get it to run on an M1. I have managed to get it working contingent on this program being able to see a few files that it wants at a ...
Mike Battaglia's user avatar
1 vote
0 answers
76 views

How to see and modify the list of user-selected files and directories that a sandboxed app has access to?

I downloaded an app from the MacOS app store. Using codesign, I can see that the app has a number of entitlements including: com.apple.security.files.user-selected.read-write; and com.apple.security....
Loax's user avatar
  • 879
1 vote
1 answer
134 views

launchd script file access blocked by sandboxd

I've written a small shell script that downloads some server data and saves them into a restic repository. The restic repository files are on a mounted volume. The script works fine if I run it in the ...
kannix's user avatar
  • 135
9 votes
3 answers
2k views

"Temporary new" MacOS installation for testing in my own machine

I own a Mac Mini 2014 running Big Sur. I've developed a program and I would like to test it in a "clean" environment, like the first day I've purchased the Mac. In particular, the frameworks ...
TheUnexpected's user avatar
0 votes
0 answers
682 views

Grant "full disk access" to sandboxed applications permanently

I'm using Microsoft Office 2016 (not 365) on macOS High Sierra. There's an annoying issue where I can open files normally but when I select a file from the "recently opened" menu it opens a ...
Joy Jin's user avatar
  • 2,833
2 votes
1 answer
1k views

What is '~/Library/Application Scripts'?

Sandboxed apps and most built in apps will automatically create a folder called their package identifier inside ~/Library/Application Scripts and will sometimes break if that directory is unavailable ...
CPlus's user avatar
  • 235
5 votes
1 answer
2k views

Saving documents from Word directly to SMB share makes them invisible

When saving a Microsoft Word document directly to a SMB share which was mounted using a bookmark and authenticated with an Open Directory "Network User Account", the saved document becomes ...
Andreas Ley's user avatar
0 votes
1 answer
209 views

Utilize "burner" user accounts to sandbox specific "sketchy" apps

There's some apps that are sort of irreplaceable for a user, yet at the same time unwanted by them, (due to violating privacy, controversial history etc.) In my case that is Google's Android File ...
robinhoodhat's user avatar
1 vote
1 answer
53 views

Can one access all application data when given physical access to an iPhone?

An answer on SO to a question on whether or not you could access stuff in the cache of Mobile Safari, stated that no, this was not possible, as each app runs in its own sandbox. I am unsure how this ...
oligofren's user avatar
  • 372
3 votes
0 answers
5k views

Unsandboxed macOS app error: System Policy: deny(1) file-read-data

I am working on a macOS app which is distributed outside of the App Store and isn't sandboxed. My understanding is that non-sandboxed apps should have access to everything that the user can access. ...
em_ly's user avatar
  • 31
3 votes
1 answer
291 views

How do I see where can a sandboxed Mac application write on my disk?

I know the app entitlements define its scope of access to resources. I already figured out how to get an app's entitlements, using the answer to this question For example, to see Safari's entitlements,...
Motti Shneor's user avatar
3 votes
0 answers
283 views

Does a 3rd-party keyboard with Allow-Full-Access ALWAYS have access to text?

As I understand from other posts, a keyboard can only: access full text with Allow-Full-Access enabled never access text inside sensitive (e.g. password) fields But how does inactivity/background ...
janniks's user avatar
  • 231
1 vote
2 answers
3k views

How can I tell if a MacOS App is notarized or sandboxed?

I'm running MacOS Catalina. How can I tell if a particular MacOS App downloaded from the Internet is notarized and/or sandboxed?
Darrell Root's user avatar
4 votes
2 answers
254 views

How much data can an app steal from my MacBook if I allow its system-wide execution?

I'm interested in knowing how to monitor and possibly sandbox an app and its relative background processes in MacOS. Is there some internal utility hidden somewhere in the system tools (even CLI), or ...
quan2m's user avatar
  • 43
3 votes
0 answers
111 views

Sandbox Apple ID disabled in the App Store and iTunes

I am attempting to test macOS In-App Purchases via a Sandbox Apple ID. When I go through the purchase flow, I get the error: Your account has been disabled in the App Store and iTunes. For assistance,...
pkamb's user avatar
  • 9,000
3 votes
1 answer
1k views

How can I force all traffic for a single app through VPN / Proxy + Open Source? aka App Firewall?

I'm looking for an app that is fully Open Source OR built-in to MacOS as I am trying to use this for security / privacy (to ensure that particular apps cannot make arbitrary connections) I have ...
Jonathan Cross's user avatar
3 votes
0 answers
453 views

rsync denied to access directory when run with launchctl

I have mounted samba share in "/Volumes/Samba" with full read/write access right to it. I created simple script to rsync files from smb share to folder on my disk, when I lunch script from terminal ...
Fedaykin's user avatar
  • 101
1 vote
1 answer
748 views

Adding Test Credit Card to Apple Pay

I'm trying to add a test credit card in my Applet Wallet (with icloud and app store signed in to my developer account). I found a list of test credit cards available from Apple's page https://...
toffee.beanns's user avatar
1 vote
1 answer
227 views

How does macOS process protection work – Cliff Notes style?

Looking at Apple dev forums and not having programmed in C since college, I'm a bit out of my depth trying to understand the fundamentals of the components of MacOS' protection model employed over the ...
Darf Nader's user avatar
6 votes
0 answers
3k views

how can I run an app in sandbox?

I wanted to play some games found on internet (not the Mac store) but I was afraid those could have a virus inside. As such I wanted to run them in a sandbox where they could just read files from ...
Thomas's user avatar
  • 513
2 votes
1 answer
682 views

Triggering Launch Agents for path in sandboxed app using WatchPaths does not work

I am trying to create a user LaunchAgents that will trigger a script when a path managed by a sandbox app will change (in my case, when /Library/Containers/com.omnigroup.OmniFocus3/Data/Library/...
Mayeu's user avatar
  • 31
5 votes
1 answer
247 views

Are applications required to be installed to the /Applications folder in order to be sandboxed?

I have an application installed in the ~/Applications folder. I've been using it for years with no problems. But after a recent update this application started giving me warnings that it should be ...
retif's user avatar
  • 591
6 votes
3 answers
1k views

Third party application cannot write to disk

I downloaded this application: Donkey Simulator And after unzipping there should be an executable file but also a folder called "log", and once the application is running, new files are written into ...
michael's user avatar
  • 113
4 votes
1 answer
710 views

iTunesConnect no longer allows tester gmail with plus sign?

In the past, I used to use the same Gmail address for testing in-app purchasing (sandbox testing) by adding + sign to my email. For example, [email protected] Now I am no longer able to ...
ipadoio's user avatar
  • 376
0 votes
1 answer
648 views

Restoring from Time Machine Backup – Cannot replace Mac HD

I'm trying to restore my computer to a previous backup of my Mac HD. However, when I try, I see an error notice telling me that I cannot, since this file is not able to be deleted: ....
NoahM's user avatar
  • 327
2 votes
0 answers
620 views

How do I create an Automator-based "Replace Text" Service that works with sandboxing?

I want to create a Service using Automator on macOS 10.12.6. I selected: Service receives selected rich text in any application Input is entire selection ☑️ Output replaces selected text I then ...
Jacob Budin's user avatar
14 votes
1 answer
14k views

How do I use my existing KeePass database on my new iPad without iTunes on a computer?

I'm a Linux user who bought an iPad. I'm also an Infosec pro who uses the KeePassX password manager. All my passwords are too long to type on the iPad - so I want to use my password manager on iPad. I ...
Sas3's user avatar
  • 191
8 votes
1 answer
1k views

How to fix sandbox violations by airportd?

I keep seeing a lot of errors like this in the console which seem to be causing beachballs: SandboxViolation: airportd(81) deny(1) file-read-metadata /Users I have a MacBook Pro (15-inch, Mid 2012) ...
2daaa's user avatar
  • 181
4 votes
1 answer
6k views

Run untrusted application safely through sandbox-exec command

I'm trying to run a potentially untrusted application without the following permissions, through the sandbox-exec command: file write (to avoid corruption/injection of files) network (to avoid ...
auino's user avatar
  • 171
4 votes
1 answer
3k views

AMFI: allowing exception handler - because the handler was set by master-entitled process ´launchd´, VirtualBox

I installed macOS Sierra 10.12 like Guest on VirtualBox 5.1.10 on my MacBook Air with macOS Sierra too. I facing errors! I login with difficulties an when I can, raise the error and I need to log in....
joseluisbz's user avatar
24 votes
2 answers
59k views

Is there a sandboxing program like Sandboxie for Mac?

With Sandboxie for Windows, you are able to run applications that you don't entirely trust in a sandbox; it tracks all files the program creates and modifies, and although the files technically go to ...
Oion Akif's user avatar
  • 9,042
2 votes
1 answer
175 views

Website in separate browser instance in IOS

In IOS, adding a website to the home screen in Safari essentially produces a Safari bookmark on the home screen. When clicking on such an icon, the website is displayed in Safari. Is there some way ...
user206954's user avatar
2 votes
1 answer
3k views

Sandbox on Mac OS X

I can't use the sandbox-exec command as I expected. The problem is that I cannot apply a custom profile with the -f switch: I get "operation not permitted" error which I could not trace to anything ...
Dex's user avatar
  • 121
0 votes
2 answers
2k views

How To Trick WeChat Into to Thinking My iPhone Is An iPad?

so I use a chatting app called WeChat and I have two phones. It only allows me to sign in on one phone at a time. But I can sign in on an iPad and a phone at the same time. It's an universal app, ...
aeroxy's user avatar
  • 3,317
5 votes
0 answers
829 views

sandboxd, pstopdf deny file-read-data and file-read-metadata

In attempting to get cups-pdf working in El Capitan, I'm running into the error that pstopdf errors out. The system.log shows that the sandbox kernel extension is denying read access to the following ...
Johnnie's user avatar
  • 151
2 votes
1 answer
481 views

How to ensure Slack runs safely in sandbox?

For work I use my personal laptop and I am required to run Slack to keep in contact with coworkers however it occurs to me that this could potentially be used as an invasive surveillance tool unless ...
moop's user avatar
  • 111
3 votes
1 answer
11k views

Configure sandbox permissions

While trying to modify a property list I was rather surprised to receive the following error sh-3.2# cp com.apple.mDNSResponder.plist com.apple.mDSNResponder.plist.backup cp: com.apple.mDSNResponder....
Matt's user avatar
  • 131