Sandbox is an application isolation for Mac OSX.
Apple has included a sandbox facility, originally code named seatbelt,
with the release of Max OSX 10.5 Leopard in 2006.
This facility includes the command sandbox, sandboxd,
sandbox_init, and sandbox-exec.
The sandbox is implemented as a policy module
for the TrustedBSD mandatory access control framework
that I previously mentioned for use with BSD.
As we know, Apple OSX is a BSD derivative,
which is why you can use this TrustedBSD framework.
You have to write a configuration file for each application
that you want to sandbox.
It’s not a point and click solution unfortunately.
You have to read through the documentation.
You have to know what you're doing.
Here is the man page for sandbox-exec,
which is a main tool that you use in order to
use the sandboxing functionality within OSX.
Also, Apple has a guide here, which you can
read on how to use the sandbox.
But I’m going to give you some quick pointers
now to get you started with, but you absolutely
have to read the documentation because it’s very specific
to the applications that you use.
So I mentioned that each application needs to have
a configuration file or a profile file that says what that
particular application or process is allowed to do.
In order to create those, you need to have root privileges.
So let’s change to root.
So now we’re root.
Let me show you an example config file that I’ve created for Firefox.
This one is based on information I found at these two URLs,
which you can see here.
Could maybe check those out as well.
If we go down here, you can get an idea
of the sort of settings that you need to make.
It looks complex, but it’s not too complex.
So what you can see here is for Firefox,
these are the read and write locations that the process
is allowed to read and write to, and that’s based on
this allow file-write and then these reads.
If we go further down, you can see similar sorts of statements.
So this is what Firefox is able to read,
or the locations it’s able to read, and files.
Here we’re inputting extra rules from the BSD.sb file,
which is essentially a file that looks like this
that has some specific BSD rules in it.
And we can also lockdown whether or not
Firefox can create any new processes.
So this is not allowed to create any new processes, only new threads.
And here we’re giving it network access so you can disallow
certain applications from having network access.
So that gives you an idea.
But if you really want to use this, then you need to read
the documentation and figure out how to use it.
But of course I would recommend you do the browser
and the email client, and of course anything
that interacts with the internet or untrusted sources.
So that was an example of a profile. So how do we
actually run Firefox using that profile?
So we have to type in a command, but we need to
exit out of root into extended non-admin user.
So that’s saying sandbox, using this configuration,
and then I need to enter the name and path of the application
that I want to sandbox with those rules.
So that’s the command there for Firefox.
And there we have an instance of Firefox protected
by the sandbox, and allowed and not allowed
based on those rules and that configuration file.
This is some example profiles here that you might find useful.
There are also examples of configurations provided by Apple,
which you can see here.
So that’s what one of them looks like after ftp-proxy.
So you see here these files might give you
a better idea of how you might configure this.
So you can see here, is an example, this is allowing
UDP port 123 and not allowing anything else.
So, it gives you a good idea.
You also get errors as well, trace results showing you
when you have problems with a file when you’ve sandboxed it,
and that can help you decide on what you want and don’t want.
There’s a Firefox profile here that you might
find useful if you want to use Firefox.
This is Buckle Up which is a tool to help you create the profiles.
A quick start guide here which you might find useful.
And this is a report by a security researcher on the Apple sandbox.
It’s worth a read if you really want to dig deeper into it.
Other than the built-in sandbox, there isn’t really that much,
at the time I’m aware of anyway for Mac.
There is SuperDuper. This has some
limited sandboxing functionalities
so I thought it was worth a mention.
So that’s it on Mac sandboxes.