4 ms·
"Users do not expect sandboxed apps to get this level of access to their systems, but it is important to note that when an open file dialog is opened by a sandb
by ken 8y ago
"Users do not expect sandboxed apps to get this level of access to their systems, but it is important to note that when an open file dialog is opened by a sandboxed app, if you use it to open your home directory, the app can potentially get access to lots of private information including browsing history, iMessage conversations, e-mail messages and more."
The macOS sandbox isn't like other sandboxes I've used (JVM, ECMAscript, Tcl, etc). Even if the user hasn't extended it by explicitly selecting a file, and even if the app has no entitlements, there seem to be a lot of holes in it -- and they seem to be intentional. The Mac sandbox can be one piece of a security solution, but you should never count on it to protect you from untrusted applications.
Of course, if you choose your home directory in a file picker, all bets are off.
The matter of user expectations is the main reason I wish Apple would revert the sandbox requirement for the Mac App Store. As a user, it really does seem like the sandbox should protect me from malicious code, just like Safari protects me from malicious JS, but it really doesn't. They want the MAS to seem safe, but it would be better for everyone if they made it clear you still need to trust the app.
- saagarjha 8y ago> "Users do not expect sandboxed apps to get this level of access to their systems, but it is important to note that when an open file dialog is opened by a sandboxed app, if you use it to open your home directory, the app can potentially get access to lots of private information including browsing history, iMessage conversations, e-mail messages and more." This access is going away in macOS Mojave, at least for the built-in system apps, for precisely this reason. > The macOS sandbox isn't like other sandboxes I've used (JVM, ECMAscript, Tcl, etc). Even if the user hasn't extended it by explicitly selecting a file, and even if the app has no entitlements, there seem to be a lot of holes in it -- and they seem to be intentional. > Of course, if you choose your home directory in a file picker, all bets are off. What holes are you talking about? Keep in mind that the examples you mention and the macOS sandbox solve different problems and have different constraints. The ones you've mentioned are meant to execute untrusted code and keep it (almost) completely isolated from the rest of your system. But macOS apps must have much more access by definition. > The matter of user expectations is the main reason I wish Apple would revert the sandbox requirement for the Mac App Store. As a user, it really does seem like the sandbox should protect me from malicious code, just like Safari protects me from malicious JS, but it really doesn't. Just curious: how do you feel about the iOS sandbox situation?
- ridiculous_fish 8y agoThe Mac sandbox is a large burden on legitimate app developers and a small burden on malicious ones.
- tinus_hn 8y agoThe file picker runs in a separate, trusted context. Only when you select a file and confirm the application gets access to that file.