You can allow access to a unix socket via things like: (allow network-outbound (remote unix-socket (path-literal "/private/var/run/syslog"))) Similarly yo

You can allow access to a unix socket via things like: (allow network-outbound (remote unix-socket (path-literal "/private/var/run/syslog"))) Similarly you can allow use of shared memory: (allow ipc-posix-shm) Most of the rule types are documented here[1]. Even for the ones that aren't, the error message in the logs uses the same syntax (e.g. if a unix socket is blocked you'll get a complaint about "network-outbound"). You mostly just need to be able to copy and paste. [1]: https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sandbox-Guide-v1.0.pdf https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sand...