Skip to content

Instantly share code, notes, and snippets.

@reinhrst
Created March 20, 2023 08:00
Show Gist options
  • Save reinhrst/ac9c4ce0323dd6919f6b4c17124e6364 to your computer and use it in GitHub Desktop.
Save reinhrst/ac9c4ce0323dd6919f6b4c17124e6364 to your computer and use it in GitHub Desktop.
Limiting sandbox
; run `sandbox-exec -f limit.sb $program`
(version 1)
(debug deny)
(deny default)
(import "/System/Library/Sandbox/Profiles/bsd.sb")
(allow network-outbound)
(deny network-outbound (remote tcp "localhost:*"))
(allow process-fork)
(allow process-exec*
(subpath "/opt/homebrew/")
(subpath "/usr/bin/")
(subpath "/bin/")
(subpath "/Volumes/Work/nitwit2gitwit/node_modules/")
)
(allow file-read*
(subpath "/Volumes/Work/nitwit2gitwit/")
(subpath "/opt/homebrew/")
)
(allow file-write*
(subpath "/Volumes/Work/nitwit2gitwit/node_modules/")
(subpath "/Volumes/Work/nitwit2gitwit/.node-cache/")
(literal "/Volumes/Work/nitwit2gitwit/package-lock.json")
(literal "/Volumes/Work/nitwit2gitwit/package.json")
(subpath "/Volumes/Work/nitwit2gitwit/")
)
(allow network-inbound)
(allow network-inbound (remote tcp "localhost:*"))
(allow file-ioctl (regex "^/dev/tty"))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment