10 ms·

I haven’t seen this anywhere when I’ve looked, so I’ll ask here on the slim chance maybe they really added something I badly want and somebody knows… Is there

I haven’t seen this anywhere when I’ve looked, so I’ll ask here on the slim chance maybe they really added something I badly want and somebody knows… Is there any application forced sandboxing feature yet? Something users can control to forcibly stop bad behavior from certain “must have” apps. Chrome, for example, has been caught doing entire drive scans on Windows, and I’m not sure I entirely trust Zoom either. So I’d like to lock down what they can access in terms of files, paths, devices and so on and be fully confident that even if my employer demands I run some software installer provided by their “partners” that it hasn’t installed some creepy daemon and configured launchd to keep it running after I kill the app or even kill -9 the process. Yes we can use VMs for this, but Mac laptops aren’t generally beefy machines, so that’s not an optimal solution. There used to be sandbox_exec, but I’ve heard they removed it entirely from this version. We’re now supposed to get things from the (cr)App Store, which guarantees the app will only have entitlements that Apple approves. But vendors are abandoning the App Store in droves for many good reasons, and after recent events I don’t totally trust Apple to prevent malicious use piggybacking on top of a legit entitlement.

DarthNebo 5y ago
This is so critical, we've been scrutinising permissions on smartphones for so long & yet we have like an unlimited buffet for consumer desktop applications this entire time.
fnord123 5y ago
> Is there any application forced sandboxing feature yet? Yes it's been there for a while. But like flatpak and all other attempts to sandbox applications they tend to ask for coarse permissions like Home Directory and once you give that, it can read everything important.
- enriquto 5y ago
  It shouldn't matter what permissions an application asks for. It is up to the user to decide to grant the app access to a system, or to a mock system. The "sandboxing" model of flatpack and the like is completely backwards. I'd even say it's user-hostile.
jxy 5y ago
Is it possible to add entitlements to an already compiled app dowloaded from a random place? A mac app installer could run any scripts, so we need to sandbox the installer, if it's possible.
concinds 5y ago
No, still no user-facing method for that. There have also been no apparent improvements to the Catalina permission dialogues (for Documents, Desktop, Downloads), but keep watching https://eclecticlight.co/ https://eclecticlight.co/ over the next few weeks, if there have been any improvements he'll probably talk about it.
0xFACEFEED 5y ago
I need this so badly. True story: I've been eagerly awaiting a new Macbook to completely rid myself of Adobe software. Over the past decade I've considered installing Adobe software but always held back because of how intrusive and shady the software is (I checked on friends' computers). I've been able to work around having to edit PDFs and used Figma in place of Photoshop for my very basic graphical needs. Well a few months ago I needed to fill out customs form 5106. This form uses some kind of proprietary Adobe PDF form creation software thing. In order to do anything with it I need Adobe Acrobat. At least that's how far my research took me before I buckled and purchased Adobe Acrobat. I was extremely busy that week and didn't have time to figure out a hacky alternative. After having installed Creative Cloud all I can say is... it's straight up malware. I doubt I'd be able to get rid of all the junk it installs even if I wanted to. And what's worse is the products are extremely buggy. It's just a mess! I just checked and Adobe has TWENTY EIGHT processes running in the background. A lot of them are running as root. And of course two of them are NodeJS servers. These processes are constantly phoning home at such a ridiculous rate that it's impossible to know what to block and what not to. Looking at Little Snitch right now, there are 13 distinct Adobe applications that have been making HTTP requests since I booted my laptop 30 minutes ago. I haven't used a single Adobe product since boot. I wasn't surprised when, after installing Creative Cloud and restarting my computer, next time I launched Chrome I got a popup telling me that Adobe installed an extension. THANK YOU GOOGLE for taking the time to alert me about this. At no point during the installation process was it clear to me that Adobe would be hijacking my browser too. I was going to do a fresh wipe to get rid of this junk for good but I wanted to wait until the Macbook was released. Once that laptop arrives I'm never touching Adobe software ever again unless there's a way to completely sandbox it.
- kayodelycaon 5y ago
  > I'm never touching Adobe software ever again unless there's a way to completely sandbox it. At this point I’m going to recommend a virtual machine.
  - 0xFACEFEED 5y ago
    I could, but I think it would take considerable effort on my part. You know how it is. You end up with a long tail of little things that don't quite work properly. Eventually I could get it to work but I'm so upset with Adobe that I'm straight up boycotting their software. I'm ashamed of this but I've fantasized about berating Adobe executives/engineers to their face if I ever met them in real life. Of course I'd never ever do that but even fantasizing about berating someone felt dirty. That's how much time and sense of security this company has sucked from my life. I still haven't had to go through the process of cancelling my Creative Cloud subscription. I'm sooo hoping they didn't throw in a bunch of dark patterns in there as well but I have feeling they will.
crooked-v 5y ago
> Yes we can use VMs for this, but Mac laptops aren’t generally beefy machines The newest ones with M1/M1 Pro are actually pretty beefy, and even the Macbook Air has benchmarks that beat literally everything else in the Apple lineup except the iMac Pros and the new-model Mac Pros. This doesn't help much with current equipment, but it should make future planning easier.
- smoldesu 5y ago
  What they really need is something powerful and open along the lines of QEMU/KVM. HyperKit is dead-last when it comes the virtualization race, and it's one of the technologies I'm rooting for Apple to scrap altogether. MacOS needs either a thinner hypervisor or a lower-level virtualization solution, either of which I see as equally unlikely from Apple.
  - ubercow13 5y ago
    QEMU runs on macos already?
    - smoldesu 5y ago
      That's news to me!
  - fastball 5y ago
    Pretty happy with Parallels performance on my M1 Mac tbh.
  - pram 5y ago
    They added a framework specifically for Linux in Big Sur. Also QEMU runs on MacOS lol https://developer.apple.com/documentation/virtualization https://developer.apple.com/documentation/virtualization
    - jxy 5y ago
      Does MacOS run on QEMU?
josephcsible 5y ago
Such a feature would be useless in practice, unless the sandbox could present convincing fake data. Without that, all of the evil apps you mention would just show a message box at startup saying "unsandbox me or I refuse to run".
tempfs 5y ago
Well... you could create a new user profile, install the apps to that user's profile, give their group access to the folders you want the browser to be able to get to (Downloads folder, whatever), then lock them out of anything else....then run the browser as that user only. aka (sudo -u Bob /Applications/Firefox.app/Contents/MacOS/Firefox ) OS perms should do the rest. I don't know if OSX has a firejail equivalent but that would be nice too.
- saagarjha 5y ago
  Chrome will request admin privileges to install Keystone, I believe.
- avinassh 5y ago
  wow, this is such a great tip. Can I use the Zoom same way?
throwaway851 5y ago
/usr/bin/sandbox-exec is still on macOS Monterey. It's not pretty, but you should still be able to roll your own sandbox rules and run any arbitrary app with it: https://mybyways.com/blog/creating-a-macos-sandbox-to-run-kodi https://mybyways.com/blog/creating-a-macos-sandbox-to-run-ko...
- Quiark 5y ago
  It's going away though and is less functional than in previous versions of the system. Basically a waste of time trying to build rules for it right now.
IceWreck 5y ago
> Is there any application forced sandboxing feature yet? On Linux you can use flatpak where you can manually limit the permissions on a per application basis.
deleted 5y ago
[deleted]
danielrhodes 5y ago
My belief is that Apple will eventually try to lock down macOS entirely or move to something similar to iOS sandboxing. This would more or less solve your problem and not hurt the majority of people’s experience. However, to make the OS good enough for software development, Apple will make it easy to create virtualized environments. This to me seems like the correct trade off and might actually be a net win for most. I have never understood why it’s a good idea to mess with your core OS to get some code to compile - use something where you don’t have to worry every time there is an OS upgrade.
- iggldiggl 5y ago
  > My belief is that Apple will eventually try to lock down macOS entirely or move to something similar to iOS sandboxing. This would more or less solve your problem and not hurt the majority of people’s experience. Strict file-level-granularity sandboxing breaks all kinds of multi-file formats [1], because users will want to simply open the respective main file just as usual (especially if launching the file from the desktop or a file explorer window) and then expect that the program of course should be able to access not just that particular file itself, but any associated files, too. The OS however cannot be expected to know the peculiarities of each and every file format, so how is this supposed to work without either degrading the user experience or else weakening the sandbox up to a point where it is possibly almost pointless? Plus it also makes editing file paths in programs more annoying, because you can no longer directly edit a path (or paste it in from elsewhere) if it's displayed in a text input and instead always have to spend a few additional clicks because you must go through the OS file picker. (Though admittedly this latter issue might be more of a power user problem) [1] Multi-part archives, multi-part video files, playlists, videos with separate subtitle files, HTML documents containing links to other local HTML documents or referencing various sub-resources (images/videos/audio/style sheets/scripts/...), Audacity projects, images with metadata in external sidecar files, ditto for georeferenced images, QGIS projects, ...
  - IIsi50MHz 5y ago
    Regarding filepicker and path editing… So, regression to several systems ago? Maybe System 7, or MacOS 8, or 9? If so, we'll need a new thing like Super Boomerang…except with all the modern security, it'd practic'ly have to come from Apple as some kind of option. )*:
lodovic 5y ago
I just watched the "What's new" thing. There is a new grid view in Facetime. Some improvements in the notification centre. Not sure if that warrants a risky 12 Gb OS update.
kube-system 5y ago
> Something users can control to forcibly stop bad behavior from certain “must have” apps. Chrome, for example, has been caught doing entire drive scans on Windows, and I’m not sure I entirely trust Zoom either. I just upgraded to Monterey and OneDrive asked for permissions to a bunch of folders it didn’t need. I denied them. I doubt it’s bad behavior, probably just lazy permissions requests, but I’m glad I had the option.
deleted 5y ago
[deleted]
Tagbert 5y ago
Sandboxing is one of the benefits that Apple taunts with apps deployed in the App Store. You have to explicitly give access to app for a range of locations. This is one reason that some publishers refuse to distribute their apps in the App Store.

DarthNebo 5y ago

This is so critical, we've been scrutinising permissions on smartphones for so long & yet we have like an unlimited buffet for consumer desktop applications this entire time.

fnord123 5y ago

> Is there any application forced sandboxing feature yet? Yes it's been there for a while. But like flatpak and all other attempts to sandbox applications they tend to ask for coarse permissions like Home Directory and once you give that, it can read everything important.

enriquto 5y ago
It shouldn't matter what permissions an application asks for. It is up to the user to decide to grant the app access to a system, or to a mock system. The "sandboxing" model of flatpack and the like is completely backwards. I'd even say it's user-hostile.

jxy 5y ago

Is it possible to add entitlements to an already compiled app dowloaded from a random place? A mac app installer could run any scripts, so we need to sandbox the installer, if it's possible.

concinds 5y ago

No, still no user-facing method for that. There have also been no apparent improvements to the Catalina permission dialogues (for Documents, Desktop, Downloads), but keep watching https://eclecticlight.co/ https://eclecticlight.co/ over the next few weeks, if there have been any improvements he'll probably talk about it.

0xFACEFEED 5y ago

I need this so badly. True story: I've been eagerly awaiting a new Macbook to completely rid myself of Adobe software. Over the past decade I've considered installing Adobe software but always held back because of how intrusive and shady the software is (I checked on friends' computers). I've been able to work around having to edit PDFs and used Figma in place of Photoshop for my very basic graphical needs. Well a few months ago I needed to fill out customs form 5106. This form uses some kind of proprietary Adobe PDF form creation software thing. In order to do anything with it I need Adobe Acrobat. At least that's how far my research took me before I buckled and purchased Adobe Acrobat. I was extremely busy that week and didn't have time to figure out a hacky alternative. After having installed Creative Cloud all I can say is... it's straight up malware. I doubt I'd be able to get rid of all the junk it installs even if I wanted to. And what's worse is the products are extremely buggy. It's just a mess! I just checked and Adobe has TWENTY EIGHT processes running in the background. A lot of them are running as root. And of course two of them are NodeJS servers. These processes are constantly phoning home at such a ridiculous rate that it's impossible to know what to block and what not to. Looking at Little Snitch right now, there are 13 distinct Adobe applications that have been making HTTP requests since I booted my laptop 30 minutes ago. I haven't used a single Adobe product since boot. I wasn't surprised when, after installing Creative Cloud and restarting my computer, next time I launched Chrome I got a popup telling me that Adobe installed an extension. THANK YOU GOOGLE for taking the time to alert me about this. At no point during the installation process was it clear to me that Adobe would be hijacking my browser too. I was going to do a fresh wipe to get rid of this junk for good but I wanted to wait until the Macbook was released. Once that laptop arrives I'm never touching Adobe software ever again unless there's a way to completely sandbox it.

kayodelycaon 5y ago
> I'm never touching Adobe software ever again unless there's a way to completely sandbox it. At this point I’m going to recommend a virtual machine.
- 0xFACEFEED 5y ago
  I could, but I think it would take considerable effort on my part. You know how it is. You end up with a long tail of little things that don't quite work properly. Eventually I could get it to work but I'm so upset with Adobe that I'm straight up boycotting their software. I'm ashamed of this but I've fantasized about berating Adobe executives/engineers to their face if I ever met them in real life. Of course I'd never ever do that but even fantasizing about berating someone felt dirty. That's how much time and sense of security this company has sucked from my life. I still haven't had to go through the process of cancelling my Creative Cloud subscription. I'm sooo hoping they didn't throw in a bunch of dark patterns in there as well but I have feeling they will.

crooked-v 5y ago

> Yes we can use VMs for this, but Mac laptops aren’t generally beefy machines The newest ones with M1/M1 Pro are actually pretty beefy, and even the Macbook Air has benchmarks that beat literally everything else in the Apple lineup except the iMac Pros and the new-model Mac Pros. This doesn't help much with current equipment, but it should make future planning easier.

smoldesu 5y ago
What they really need is something powerful and open along the lines of QEMU/KVM. HyperKit is dead-last when it comes the virtualization race, and it's one of the technologies I'm rooting for Apple to scrap altogether. MacOS needs either a thinner hypervisor or a lower-level virtualization solution, either of which I see as equally unlikely from Apple.
- ubercow13 5y ago
  QEMU runs on macos already?
  - smoldesu 5y ago
    That's news to me!
- fastball 5y ago
  Pretty happy with Parallels performance on my M1 Mac tbh.
- pram 5y ago
  They added a framework specifically for Linux in Big Sur. Also QEMU runs on MacOS lol https://developer.apple.com/documentation/virtualization https://developer.apple.com/documentation/virtualization
  - jxy 5y ago
    Does MacOS run on QEMU?

josephcsible 5y ago

Such a feature would be useless in practice, unless the sandbox could present convincing fake data. Without that, all of the evil apps you mention would just show a message box at startup saying "unsandbox me or I refuse to run".

tempfs 5y ago

Well... you could create a new user profile, install the apps to that user's profile, give their group access to the folders you want the browser to be able to get to (Downloads folder, whatever), then lock them out of anything else....then run the browser as that user only. aka (sudo -u Bob /Applications/Firefox.app/Contents/MacOS/Firefox ) OS perms should do the rest. I don't know if OSX has a firejail equivalent but that would be nice too.

saagarjha 5y ago
Chrome will request admin privileges to install Keystone, I believe.
avinassh 5y ago
wow, this is such a great tip. Can I use the Zoom same way?

throwaway851 5y ago

/usr/bin/sandbox-exec is still on macOS Monterey. It's not pretty, but you should still be able to roll your own sandbox rules and run any arbitrary app with it: https://mybyways.com/blog/creating-a-macos-sandbox-to-run-kodi https://mybyways.com/blog/creating-a-macos-sandbox-to-run-ko...

Quiark 5y ago
It's going away though and is less functional than in previous versions of the system. Basically a waste of time trying to build rules for it right now.

IceWreck 5y ago

> Is there any application forced sandboxing feature yet? On Linux you can use flatpak where you can manually limit the permissions on a per application basis.

deleted 5y ago

[deleted]

danielrhodes 5y ago

My belief is that Apple will eventually try to lock down macOS entirely or move to something similar to iOS sandboxing. This would more or less solve your problem and not hurt the majority of people’s experience. However, to make the OS good enough for software development, Apple will make it easy to create virtualized environments. This to me seems like the correct trade off and might actually be a net win for most. I have never understood why it’s a good idea to mess with your core OS to get some code to compile - use something where you don’t have to worry every time there is an OS upgrade.

iggldiggl 5y ago
> My belief is that Apple will eventually try to lock down macOS entirely or move to something similar to iOS sandboxing. This would more or less solve your problem and not hurt the majority of people’s experience. Strict file-level-granularity sandboxing breaks all kinds of multi-file formats [1], because users will want to simply open the respective main file just as usual (especially if launching the file from the desktop or a file explorer window) and then expect that the program of course should be able to access not just that particular file itself, but any associated files, too. The OS however cannot be expected to know the peculiarities of each and every file format, so how is this supposed to work without either degrading the user experience or else weakening the sandbox up to a point where it is possibly almost pointless? Plus it also makes editing file paths in programs more annoying, because you can no longer directly edit a path (or paste it in from elsewhere) if it's displayed in a text input and instead always have to spend a few additional clicks because you must go through the OS file picker. (Though admittedly this latter issue might be more of a power user problem) [1] Multi-part archives, multi-part video files, playlists, videos with separate subtitle files, HTML documents containing links to other local HTML documents or referencing various sub-resources (images/videos/audio/style sheets/scripts/...), Audacity projects, images with metadata in external sidecar files, ditto for georeferenced images, QGIS projects, ...
- IIsi50MHz 5y ago
  Regarding filepicker and path editing… So, regression to several systems ago? Maybe System 7, or MacOS 8, or 9? If so, we'll need a new thing like Super Boomerang…except with all the modern security, it'd practic'ly have to come from Apple as some kind of option. )*:

lodovic 5y ago

I just watched the "What's new" thing. There is a new grid view in Facetime. Some improvements in the notification centre. Not sure if that warrants a risky 12 Gb OS update.

kube-system 5y ago

> Something users can control to forcibly stop bad behavior from certain “must have” apps. Chrome, for example, has been caught doing entire drive scans on Windows, and I’m not sure I entirely trust Zoom either. I just upgraded to Monterey and OneDrive asked for permissions to a bunch of folders it didn’t need. I denied them. I doubt it’s bad behavior, probably just lazy permissions requests, but I’m glad I had the option.

deleted 5y ago

[deleted]

Tagbert 5y ago

Sandboxing is one of the benefits that Apple taunts with apps deployed in the App Store. You have to explicitly give access to app for a range of locations. This is one reason that some publishers refuse to distribute their apps in the App Store.