Unit 1: How a Mac protects itself · Lesson 4 of 5 · 18 min
Sandboxes and entitlements
Read an app's entitlements to see what it is allowed to do, and spot the ones that weaken protection.
mission
- You are
- You are the IT security lead at Lumen Studio.
- Situation
- Designers want a new terminal app called QuickShell. Before approving it you compare its entitlements with two apps you already trust.
- Goal
- Find which apps are sandboxed and which ask for exceptions.
- Hand in
- An approve or review note for QuickShell.
Entitlements are signed key value pairs inside an app. They switch the sandbox on and grant exceptions, such as network access or loading unsigned libraries. They are part of the signature, so an app cannot change them without breaking it.
Read a sandboxed app
Canvas Pro is sandboxed and asks only for files the user picks, network access and printing.
codesign -d --entitlements - "/Applications/Canvas Pro.app"
Executable=/Applications/Canvas Pro.app/Contents/MacOS/Canvas Pro
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
[Key] com.apple.security.files.user-selected.read-write
[Value]
[Bool] true
[Key] com.apple.security.network.client
[Value]
[Bool] true
[Key] com.apple.security.print
[Value]
[Bool] true
you should see com.apple.security.app-sandbox is true.
Compare with Apple's Notes
Apple's own apps follow the same model.
codesign -d --entitlements - /System/Applications/Notes.app
Executable=/System/Applications/Notes.app/Contents/MacOS/Notes
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
[Key] com.apple.security.files.user-selected.read-write
[Value]
[Bool] true
[Key] com.apple.security.network.client
[Value]
[Bool] true
[Key] com.apple.security.personal-information.photos-library
[Value]
[Bool] true
you should see Sandboxed, plus access to the photo library.
Read QuickShell
A terminal cannot be sandboxed, but some exceptions deserve a second look.
codesign -d --entitlements - /Applications/QuickShell.app
Executable=/Applications/QuickShell.app/Contents/MacOS/QuickShell
[Dict]
[Key] com.apple.security.cs.disable-library-validation
[Value]
[Bool] true
you should see No sandbox, and library validation is disabled, so it will load libraries signed by anyone.
defender tip disable-library-validation lets unsigned plugins run inside a trusted app. Attackers use such apps to borrow their permissions.
See the containers
Each sandboxed app keeps its data in its own container folder.
ls ~/Library/Containers
com.apple.mail com.apple.Notes com.brightline.canvaspro
you should see One folder per sandboxed app, named after its bundle identifier.
What a defender takes away
- 1The sandbox limits what a compromised app can reach.
- 2Entitlements list the exceptions; read them before approving an app.
- 3disable-library-validation and similar exceptions are worth a review, not an automatic no.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.