3 ms·

Okay so you give the sandboxed app access to ~/Documents and those get encrypted… I think most people don’t care about their system directories but their data?

Okay so you give the sandboxed app access to ~/Documents and those get encrypted… I think most people don’t care about their system directories but their data? Backups and onedrive for enterprises, yes. :)

stavros 2y ago
Obviously if you give all sandboxed processes access to /, that doesn't improve anything. The idea is that you'd notice that your new git binary is trying to get access to /var/postgres, and you'd deny it, because it has no reason to want that.