cedws

macOS Sandbox Profiles: A Practical Guide for Security

This tutorial provides a practical overview of macOS sandbox profiles (.sb files) used with sandbox-exec. It focuses on understanding the structure, common elements, and how to craft them for specific use cases.

What is Sandbox-Exec?

sandbox-exec is a command-line utility on macOS that allows you to execute a program within a restricted environment, defined by a sandbox profile. This profile specifies what resources the program can access, enhancing security by limiting the potential damage from vulnerabilities.

Why Use Sandbox Profiles?

cedws

FROM golang:latest

WORKDIR /build
COPY . .

ARG GITHUB_HOST_KEY_ED25519="AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"

ARG CI
ARG GIT_CONFIG_COUNT=${CI:+0}

cedws

MTProto Proxy Setup

This guide uses mtg because it looks like the most easy and foolproof option.

• Create a VM/VPS
• (Optional) Create a DNS A record
• Install Docker CE
  • Ubuntu: https://docs.docker.com/engine/install/ubuntu/
  • Fedora: https://docs.docker.com/engine/install/fedora/
• Generate a shared secret

cedws

#!/bin/sh
DEFER=
defer() {
    DEFER="$*; ${DEFER}"
    trap "{ $DEFER }" EXIT
}

cedws

# This Dockerfile is not pure and should not be used as anything other than a reference.
# You can build an image by running `docker build -t sway -f fedora29 .`

FROM fedora:29

# Install build dependencies.
RUN dnf install -y git gcc meson ninja-build 

# Install dependencies.
RUN dnf install -y wayland-devel wayland-protocols-devel mesa-libEGL-devel mesa-libGLES-devel libdrm-devel libgbm-devel libxkbcommon-devel libudev-devel pixman-devel libinput-devel libevdev-devel systemd-devel cairo-devel libpcap-devel json-c-devel pam-devel pango-devel pcre-devel gdk-pixbuf2-devel

cedws

import asyncio

import aiohttp

# I'm importing Pillow-SIMD for increased performance, but you can use ordinary Pillow if you wish.
from PIL import ImageFile

# The remote image we'll be finding the dimensions for.
SOURCE = "http://rustacean.net/assets/rustacean-orig-noshadow.png"

cedws

const PROGRAM: &str = "++++++++[>++++[>++>+++>+++>+<<<<-]>+>+>->>+[<]<-]>>.>---.+++++++..+++.>>.<-.<.+++.------.--------.>>+.>++.";
const MAX_SCOPES: usize = 16;
const ALLOC_BLOCK_SIZE: usize = 128;

#[derive(Copy, Clone)]
enum Instruction {
    PointerLeft,
    PointerRight,
    Increment,
    Decrement,