4 ms·

https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+10.13.6&format=html https://man.freebsd.org/cgi/man.cgi?query=sandbox-e

by Someone 8mo ago

https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+10.13.6&format=html https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop...: “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 (https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+26.3&format=html https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop...) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.

MillionOClock 8mo ago
I wonder how many major applications and tools depend on sandbox-exec today despite that depreciation, IIRC I can think of the Codex CLI and Swift Package Manager.
- selridge 8mo ago
  Claude, Firefox, safari, chrome, etc etc etc etc Basically everyone who has to care about security on the Mac.
  - theowaway213456 8mo ago
    Bazel as well.
    - frizlab 8mo ago
      and Homebrew!
cpach 8mo ago
Does anyone have any details regarding the deprecation? I wonder why Apple made this decision.
- TingPing 8mo ago
  I don’t know if there are problems with this tool, but the App Sandbox is very configurable and every app store app is in one. It doesn’t make sense to maintain two different complex sandboxing solutions.
  - selridge 8mo ago
    That’s not true. Lots of apple’s own first party apps use SBPL to sandbox because the entitlement granularity doesn’t cut it. There’s also lots of apps on the MAS which use temporary-exception SBPL to fully sandbox. I agree that there is no sense in operating dual systems, but entitlements can’t replace SBPL yet.
    - VogonPoetry 8mo ago
      The Sandboxing and Entitlements mechanisms are very different. Sandboxing can only drop access to resources, it cannot grant access that was not already there [1]. Entitlements are all about giving additional selective privileges or to make the sandbox NOT remove access (like full disk access or debug ability ). Entitlements are bound to processes only and are non-transferable. This is in contrast to a capability based system where they can be passed around. Reasoning about capabilities is challenging because analysis effectively requires global knowledge of the system. Binding entitlements to libraries or Frameworks would turn them into capabilities. [1] a GUI app can restore access to files by using a trusted external selection process. Edit: change footnote reference to prevent markup error.
      - selridge 8mo ago
        This is true. I was being brash. Let me say instead that the split in reasoning and evaluation as it exists on macOS in this area is rough and potentially not needed. Granted, I don't have a better answer in my back pocket, and the fact that Apple has kicked the can for 15 years on trying to harmonize these is a sign it's hard.
        8mo ago
raphaelmolly8 8mo ago
[dead]
extra88 8mo ago
Meh, cron on OS X/macOS has been deprecated for over 20 years.
- egorfine 8mo ago
  And its binary is banned on certain macOS installations. I have two identical mac minis with the very same OS version. On one cron runs, on the other the cron binary doesn't run (killed: 9) even if I re-sign the binary in different location with my own codesigning identity. It's that banned.
  - derefr 8mo ago
    That's fascinating. I'd love to see a shasum tree of both OS installs to know if this was due to some path-dependent upgrade sequence one of the machines went through; or whether this is down to some sub-model-number hardware-component stepping issue with power efficiency or something, that only one of the machines is affected by, where the implemented launchd solution is "don't let cron run."
    - egorfine 8mo ago
      The one machine where cron was working, had crontabs prior to upgrade to 15.x. The other had none. I have googled back then and discovered that yes Apple specifically want us to suffer with their braindamaged launchd instead of cron, and thus they went to extraordinary lengths to get rid of working tools. Anyway, cron is easy to rebuild from sources, so that's what I did.
  - extra88 8mo ago
    Why would Apple "ban" a binary they ship with the OS? If I just run /usr/sbin/cron on my Apple Silicon Mac, the output is "Killed: 9" but if I actually create a crontab for a user, it works.
    - egorfine 8mo ago
      crontab exits immediately on one of the macs. The other had crontabs prior to upgrading to 15.something.

by Someone 8mo ago

MillionOClock 8mo ago

I wonder how many major applications and tools depend on sandbox-exec today despite that depreciation, IIRC I can think of the Codex CLI and Swift Package Manager.

selridge 8mo ago
Claude, Firefox, safari, chrome, etc etc etc etc Basically everyone who has to care about security on the Mac.
- theowaway213456 8mo ago
  Bazel as well.
  - frizlab 8mo ago
    and Homebrew!

cpach 8mo ago

Does anyone have any details regarding the deprecation? I wonder why Apple made this decision.

TingPing 8mo ago
I don’t know if there are problems with this tool, but the App Sandbox is very configurable and every app store app is in one. It doesn’t make sense to maintain two different complex sandboxing solutions.
- selridge 8mo ago
  That’s not true. Lots of apple’s own first party apps use SBPL to sandbox because the entitlement granularity doesn’t cut it. There’s also lots of apps on the MAS which use temporary-exception SBPL to fully sandbox. I agree that there is no sense in operating dual systems, but entitlements can’t replace SBPL yet.
  - VogonPoetry 8mo ago
    The Sandboxing and Entitlements mechanisms are very different. Sandboxing can only drop access to resources, it cannot grant access that was not already there [1]. Entitlements are all about giving additional selective privileges or to make the sandbox NOT remove access (like full disk access or debug ability ). Entitlements are bound to processes only and are non-transferable. This is in contrast to a capability based system where they can be passed around. Reasoning about capabilities is challenging because analysis effectively requires global knowledge of the system. Binding entitlements to libraries or Frameworks would turn them into capabilities. [1] a GUI app can restore access to files by using a trusted external selection process. Edit: change footnote reference to prevent markup error.
    - selridge 8mo ago
      This is true. I was being brash. Let me say instead that the split in reasoning and evaluation as it exists on macOS in this area is rough and potentially not needed. Granted, I don't have a better answer in my back pocket, and the fact that Apple has kicked the can for 15 years on trying to harmonize these is a sign it's hard.
      - 8mo ago

raphaelmolly8 8mo ago

[dead]

extra88 8mo ago

Meh, cron on OS X/macOS has been deprecated for over 20 years.

egorfine 8mo ago
And its binary is banned on certain macOS installations. I have two identical mac minis with the very same OS version. On one cron runs, on the other the cron binary doesn't run (killed: 9) even if I re-sign the binary in different location with my own codesigning identity. It's that banned.
- derefr 8mo ago
  That's fascinating. I'd love to see a shasum tree of both OS installs to know if this was due to some path-dependent upgrade sequence one of the machines went through; or whether this is down to some sub-model-number hardware-component stepping issue with power efficiency or something, that only one of the machines is affected by, where the implemented launchd solution is "don't let cron run."
  - egorfine 8mo ago
    The one machine where cron was working, had crontabs prior to upgrade to 15.x. The other had none. I have googled back then and discovered that yes Apple specifically want us to suffer with their braindamaged launchd instead of cron, and thus they went to extraordinary lengths to get rid of working tools. Anyway, cron is easy to rebuild from sources, so that's what I did.
- extra88 8mo ago
  Why would Apple "ban" a binary they ship with the OS? If I just run /usr/sbin/cron on my Apple Silicon Mac, the output is "Killed: 9" but if I actually create a crontab for a user, it works.
  - egorfine 8mo ago
    crontab exits immediately on one of the macs. The other had crontabs prior to upgrading to 15.something.