interesting, i agree with the bad choice of nomenclature though.
I wonder how hard it would be to port it to dtrace (also dtrace would defeat the not needing root requirement).
although macs already include a sandbox[1] i find it everything but intuitive to use. it's already ridiculously complicated to setup. see ironfox as reference [2]. since you have to allow all sorts of mach port process execution pasteboard mach port access, etc.
check this app, which is allowed to play music and access the clipboard, but not access the internet. [3]
It would probably be possible using destructive actions (e.g. use raise() to kill the process if it tries to do something bad). It would require root and not be easier than using OS X's built-in sandbox (i.e. if you need to allow access to some Mach services for some APIs to work, that still needs to happen regardless of what you're using to sandbox), but it could potentially be more secure, as OS X doesn't otherwise support limiting syscalls to a small set like seccomp on Linux.
Comments
interesting, i agree with the bad choice of nomenclature though.
I wonder how hard it would be to port it to dtrace (also dtrace would defeat the not needing root requirement).
although macs already include a sandbox[1] i find it everything but intuitive to use. it's already ridiculously complicated to setup. see ironfox as reference [2]. since you have to allow all sorts of mach port process execution pasteboard mach port access, etc.
check this app, which is allowed to play music and access the clipboard, but not access the internet. [3]
[1] https://developer.apple.com/library/mac/documentation/Darwin...
[2] https://www.romab.com/ironfox/IronFox-1.5-beta.dmg
[3] https://gist.github.com/03a481b6d39912b33d52
Can dtrace do sandboxing the way ptrace can? I didnt think it could.
It would probably be possible using destructive actions (e.g. use raise() to kill the process if it tries to do something bad). It would require root and not be easier than using OS X's built-in sandbox (i.e. if you need to allow access to some Mach services for some APIs to work, that still needs to happen regardless of what you're using to sandbox), but it could potentially be more secure, as OS X doesn't otherwise support limiting syscalls to a small set like seccomp on Linux.