3 ms·
I just don't known what to make of OP last sentence : > Note that I chose the directory /Users/Shared to avoid macOS "privacy protections" that prevent interac
by Twisell 6y ago
I just don't known what to make of OP last sentence :
> Note that I chose the directory /Users/Shared to avoid macOS "privacy protections" that prevent interaction with various other directories such as Desktop, Documents, and Downloads.
If the script can't access protected locations did it actually break the sandbox? Can you actually run the file in /Users/Shared scripts afterward and access those locations from there on? On Catalina the shell is kinda sandboxed when run interactively, does this exploit bypass by tuning as TextEdit?
- mike_d 6y agoThere is a bit of confusion because macOS has two sandboxes: app store app isolation and permissions and file system isolation. Think of the latter as everything on the file system except /Users and a few other cherry picked directories being mounted from a read-only CD-ROM.
- saagarjha 6y agoThe latter usually goes by the name "Data Vaults" and actually extends to a blacklist of directories (and at a technical level is enforced in a different manner). Things like ~/Documents, ~/Downloads and ~/Desktop are inaccessible to applications without permission.