3 ms·
I'm more interested to know about system call and filesystem access restrictors. I think pf is only a packet filter.
by gpvos 8y ago
I'm more interested to know about system call and filesystem access restrictors. I think pf is only a packet filter.
- Fnoord 8y agoThere's SIP and Keychain, but it does not prevent say Safari from accessing Mail or user memory in general. If macOS becomes an iOS port (instead of iOS being the derivative work of the barely used UNIX system called macOS) perhaps we'd see some of the iOS specific hardening. AFAIK that kind of sandboxing does not exist in macOS. How difficult would it be to port something like pledge or unveil to macOS?