How to macOS sandbox a Go application

00_README.md

Sandboxing a Go program in macOS

This sample Go file shows how to use sandbox_init on macOS (now deprecated, but it still works) to prevent a Go application from accessing the network beyond localhost.

01_sandbox.go

package main

/*
#include <stdlib.h>
#include <sandbox.h>
*/
import "C"
import (
	"log"
	"os"
	"os/signal"
	"unsafe"
)

func main() {
	Sandbox(`
		(version 1)
		(allow default)
		(deny network-outbound)
		(allow network-outbound (remote ip "localhost:*"))
	`)

	c := make(chan os.Signal, 1)
	signal.Notify(c, os.Interrupt)

	log.Println("main is now sandboxed, ctrl+c to quit")

	<-c
}

func Sandbox(policy string) {
	cPolicy := C.CString(policy)
	defer C.free(unsafe.Pointer(cPolicy))
	var errorBuffer *C.char
	defer C.free(unsafe.Pointer(errorBuffer))
	if result := C.sandbox_init(cPolicy, 0, &errorBuffer); result != 0 {
		log.Fatalf("Failed to initialize sandbox: return=%d; error=%s", result, C.GoString(errorBuffer))
	}
}