# Mac App Store Sandbox Escape

DevFeed: [Mac App Store Sandbox Escape](<https://devfeed.tech/articles/mac-app-store-sandbox-escape-27358.md>)

Original publisher: [Read original article](<https://saagarjha.com/blog/2020/05/20/mac-app-store-sandbox-escape/>)

Published: 2020-05-20T00:00:00Z

Content type: article

Language: en

Sources: [Saagar Jha](<https://devfeed.tech/sources/saagar-jha.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [iOS](<https://devfeed.tech/topics/ios.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [app-store](<https://devfeed.tech/tags/app-store.md>), [apple](<https://devfeed.tech/tags/apple.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [ios](<https://devfeed.tech/tags/ios.md>), [macos](<https://devfeed.tech/tags/macos.md>), [sandboxing](<https://devfeed.tech/tags/sandboxing.md>), [security](<https://devfeed.tech/tags/security.md>), [spi](<https://devfeed.tech/tags/spi.md>), [unix](<https://devfeed.tech/tags/unix.md>)

## AI overview

This article explains macOS App Sandbox architecture and reports a flaw in sandbox initialization that allowed malicious Mac App Store applications to bypass restrictions and perform unauthorized operations, including accessing sensitive user data. It states that Apple changed the Mac App Store and that the described technique should no longer work.

## Source excerpt

The App Sandbox, originally introduced in Mac OS X Leopard as "the Seatbelt", is a macOS security feature modeled after FreeBSD's Mandatory Access Control (left unabbreviated for clarity) that serves as a way to restrict the abilities of an application beyond the usual user- and permission-based systems that UNIX offers. The full extent of the capabilities the sandbox manages is fairly broad, ranging from file operations to Mach calls, and is specified in a custom Scheme implementation called the Sandbox Profile Language (SBPL). The sandbox profiles that macOS ships with can be found in /System/Library/Sandbox/Profiles, and while their format is technically SPI (as the header comment on them will tell you) there is fairly extensive third-party documentation. The implementation details of sandboxing are not intended to be accessed by third-party developers, but applications on Apple's platforms can request (and in some cases, such as new applications distributed on the Mac App Store and all applications for Apple's embedded platforms, must function in) a sandbox specified by a fixed, system-defined profile (on macOS, application.sb). Barring a few exceptions (which usually require additional review and justification for their use) this system-provided sandbox provide an effective way to prevent applications from accessing user data without consent or performing undesired system modifications.