13
votes
Is there a sandboxing program like Sandboxie for Mac?
MacOS has a build in Sandbox feature which may help you but does not exactly have the same functionality as Sandboxy.
This Paolo Fabio Zaino's Blog post from 2015 explains how to run Applications in ...
- 259
13
votes
"Temporary new" MacOS installation for testing in my own machine
If you're okay with rebooting, you can do this easily without using virtual machines:
Open Disk Utility and select your Macintosh HD on the sidebar.
Click the [+] Volume button in the toolbar and ...
- 10.4k
10
votes
"Temporary new" MacOS installation for testing in my own machine
The easiest method is probably to install a virtual machine with a clean macOS install and test your software from there. You'll need virtualization software such as VMware Fusion or Parallels Desktop ...
- 79.6k
10
votes
Accepted
Sandbox: Python deny(1) file-read-data
Well, I'm not sure how this option got set but User Script Sandboxing was turned on in MyTarget > Build Settings > Build Options. Turning it off fixed the issue.
- 437
7
votes
Are applications required to be installed to the /Applications folder in order to be sandboxed?
No, it is not really so. Being or not being stored in /Applications is not the determining factor in deciding whether or not an app is sandboxed.
No, other folders are not "less secure" than /...
- 79.6k
4
votes
AMFI: allowing exception handler - because the handler was set by master-entitled process ´launchd´, VirtualBox
I found my problem!
I was using in VirtualBox 5.1.14. Type:Mac OS X and Version:Mac OS X 10.11 El Capitan (64-bit) the problem raise up!
But using Version:Mac OS X (64-bit) works perfectly.
- 805
4
votes
How much data can an app steal from my MacBook if I allow its system-wide execution?
This is not an exact answer to what you are looking for, but it is ONE way that you can keep your system safe.
Basically it is an outbound firewall that I have been using for years (I hold no ...
- 23.1k
4
votes
Accepted
What is '~/Library/Application Scripts'?
~/Library/Application Scripts is a directory for apps to run user-supplied scripts. This is largely useful to sandboxed apps, as scripts in this directory gets special privileges to execute outside ...
- 2,143
4
votes
Utilize "burner" user accounts to sandbox specific "sketchy" apps
I'd be more inclined towards a 'burner' VM macOS install if you're that worried. Duplicate it before any sketchy install, so you can just delete it after use, keeping the 'master' VM safe.
- 118k
3
votes
Accepted
How much data can an app steal from my MacBook if I allow its system-wide execution?
Deny any app that needs a background helper and elevated access would be the safe way to sandbox and protect your data.
If you grant full disk access and your admin password, all of your data is ...
- 241k
3
votes
How do I see where can a sandboxed Mac application write on my disk?
Any sandboxed app always has full access to anywhere in its own sandbox. Safari's sandbox is
~/Library/Containers/com.apple.Safari
grg♦
- 206k
3
votes
How does macOS process protection work – Cliff Notes style?
Apple's Documentation Archive
See Apple's App Sandbox Design Guide for both an overview and in-depth discussion of how sandboxing works on their platforms.
You secure your app against attack from ...
- 44.6k
3
votes
Accepted
Third party application cannot write to disk
The logs are indeed getting created. I executed the app on a Mac running macOS High Sierra 10.13.4 (17E199). I have verified the log creation by precisely following the steps documented on the linked ...
- 52.9k
3
votes
Process (fmfd) spamming my console with sandbox denies
fmfd - Find my friends daemon, is part of MacOS, and you probably should let it run. If it experiences errors (and logs them) better try to understand what (else) is broken on your Mac. In your case, ...
- 682
2
votes
Is there a sandboxing program like Sandboxie for Mac?
Well, there is this app - https://www.macupdate.com/app/mac/19025/sandbox
Sandbox, But I am not sure if this works well with the latest edition. As such all the apps need to be sandboxed according to ...
- 31
2
votes
Third party application cannot write to disk
Did you try creating a new folder in the Applications folder (i.e. "Donkey Simulator") and then moving the application inside of that folder?
- 2,399
2
votes
iTunesConnect no longer allows tester gmail with plus sign?
I am seeing the same thing. It's weird because the title of the validation popup says that the password is the problem.
For what it's worth I'm using a temporary email provider and just generating a ...
- 151
2
votes
Third party application cannot write to disk
From reading the Mac install instructions, once you unzip the downloaded archive file you have a folder you then move to (the root level) /Applications folder. However, if your account is a standard ...
- 1,333
2
votes
How can I tell if a MacOS App is notarized or sandboxed?
You can tell this with taccy from the Eclectic Light Company. It reports directly on whether an app is notarized (although I find its "Developer ID" checkbox behavior confusing -- it doesn't check it ...
- 34.3k
2
votes
How can I tell if a MacOS App is notarized or sandboxed?
I'm not sure if this helps but if you open System Information and in the side bar, go down to Software > Applications, you should see all the applications installed on your Mac. Clicking on any app ...
- 1,574
2
votes
How can I force all traffic for a single app through VPN / Proxy + Open Source? aka App Firewall?
I have looked into things like the built in app sandboxing via sandbox-exec which seems promising
sandbox-exec (deprecated, according to its man-page) is a utility of restriction framework with allow-...
- 992
2
votes
Can one access all application data when given physical access to an iPhone?
The sandbox protects data from app A from being accessed by app B, it doesn't protect data against the OS or any OS-level access. And as has already been mentioned in the comments: Once an attacker ...
- 104k
2
votes
Accepted
How to submit a macOS app to app Store without sandboxed?
You cannot submit a macOS app to the App Store without being subject to sandboxing as it is right now.
Ofcourse, it is possible that Apple would make a special exception for you - but in general, I ...
- 79.6k
2
votes
How to submit a macOS app to app Store without sandboxed?
Appropriately Sandboxed
Apple requires all applications submitted to the Mac App Store to be sandboxed, see section 2.4.5 of the App Store Review Guidelines:
2.4.5 Apps distributed via the Mac App ...
- 44.6k
2
votes
App and Terminal Isolation / Sandboxing
There seems to be something called sandbox-exec which accepts a "seat-belt" file .sb which is a set of permissions regarding what the app or script can access.
Where I found out about this: ...
- 718
2
votes
Is launchd confined by SIP or AMFI?
launchd is tightly integrated with Sandbox, entitlements etc.
I did some research on this and came upon this very interesting article from The Eclectic Light Company; AMFI: checking file integrity on ...
- 104k
2
votes
running apache built from source sandbox access denied
Please go to System Preferences > Privacy & Security > Full Disk Access and add the httpd binary to the allowed list. Then restart the server.
- 3,015
1
vote
Mac OS “sandbox” on Mac OS
No, that would be the easiest way. Some Gatekeeper dependencies such as for example certificates, trusts, invalidations, etc. are kept globally.
As you mention, just creating a new user account is not ...
- 79.6k
1
vote
launchd script file access blocked by sandboxd
I found out that in a chain of scripts, the parent caller needs to have the correct privileges, to prevent a block by sandboxd. So, I've simply added the following programs for full-disk access:
bash
...
- 135
1
vote
"Temporary new" MacOS installation for testing in my own machine
Macs can boot an external USB fob.
Super easy. Get any respectable USB "fob" and format it in Disk Utility. Then run the OS installer and tell it to install on the USB fob.
When it comes ...
Only top scored, non community-wiki answers of a minimum length are eligible