undefined | Better HN

0 pointsTingPing1mo ago0 comments

I don’t know if there are problems with this tool, but the App Sandbox is very configurable and every app store app is in one. It doesn’t make sense to maintain two different complex sandboxing solutions.

0 comments

bdash1mo ago

App Sandbox is fundamentally a way for programs to use the underlying sandbox subsystem without having to write SBPL code themselves. When a program has opted into the App Sandbox, the system applies one of these sandbox policies automatically during app initialization. The policy examines the entitlements of the application to determine which additional resources should be permitted. See /System/Library/Sandbox/Profiles/application.sb if you're curious.

By far the biggest advantage of App Sandbox is that the policy ships along with the OS. If a system framework changes what resources it accesses in a software update, Apple can update the policy so the framework functionality still works. If your app uses a custom sandbox policy, you're on your own to both notice that something has changed and to update your policy.

The downside is that the App Sandbox policy is limiting and inflexible.

selridge1mo ago

That’s not true. Lots of apple’s own first party apps use SBPL to sandbox because the entitlement granularity doesn’t cut it. There’s also lots of apps on the MAS which use temporary-exception SBPL to fully sandbox.

I agree that there is no sense in operating dual systems, but entitlements can’t replace SBPL yet.

VogonPoetry1mo ago

The Sandboxing and Entitlements mechanisms are very different. Sandboxing can only drop access to resources, it cannot grant access that was not already there [1]. Entitlements are all about giving additional selective privileges or to make the sandbox NOT remove access (like full disk access or debug ability ). Entitlements are bound to processes only and are non-transferable. This is in contrast to a capability based system where they can be passed around. Reasoning about capabilities is challenging because analysis effectively requires global knowledge of the system. Binding entitlements to libraries or Frameworks would turn them into capabilities.

[1] a GUI app can restore access to files by using a trusted external selection process.

Edit: change footnote reference to prevent markup error.

selridge1mo ago

This is true. I was being brash. Let me say instead that the split in reasoning and evaluation as it exists on macOS in this area is rough and potentially not needed. Granted, I don't have a better answer in my back pocket, and the fact that Apple has kicked the can for 15 years on trying to harmonize these is a sign it's hard.

1 more reply

jen201mo ago

If swift package manager is using it (I believe it is based on some of the error messages I occasionally see from it), deprecating it is difficult, since SPM is not distributed as an App Store app.

j / k navigate · click thread line to collapse

0 comments

bdash1mo ago

The downside is that the App Sandbox policy is limiting and inflexible.

selridge1mo ago

I agree that there is no sense in operating dual systems, but entitlements can’t replace SBPL yet.

VogonPoetry1mo ago

[1] a GUI app can restore access to files by using a trusted external selection process.

Edit: change footnote reference to prevent markup error.

selridge1mo ago

1 more reply

jen201mo ago

If swift package manager is using it (I believe it is based on some of the error messages I occasionally see from it), deprecating it is difficult, since SPM is not distributed as an App Store app.

j / k navigate · click thread line to collapse