Sandbox app wrapping shell command

Question

devfunshark OP

Created Jun ’22

Replies 4

Boosts 0

Views 1.9k

Participants 2

I need to embed a shell command inside an app. They way I am currently solving this is by using Automator.app.

It runs well enough except that it feels wrong security-wise because the resulting app has no hardened runtime, no sandbox.

I tried to emulate what Automator.app does directly in xcode, by selecting the proejct template "Command line tool". However, as soon as I enable the app sandbox, it crashes. I can still get the hardened runtime though.

So a few quick questions:

Are sandbox only to protect against the app itself (in which case I should not worry because I trust my own code), or - similarly to hardened runtime - it also protects against attacks on the app ?
I tried using the template "app". That obviously allows sandboxes, but that is not what I want because there is a GUI
any thoughts on the best way to solve my original goal?

Thanks!

Boost

Answer 1

DTS Engineer OP

Apple

Jun ’22

Sandbox app wrapping shell command

See Embedding a Command-Line Tool in a Sandboxed App.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

devfunshark OP

Jun ’22

Thanks for the link. I saw this, but this is not exactly the use case : I was hoping to have only a simple command line tool, not embedded inside an app. I guess it's not really possible.

0

Answer 3

DTS Engineer OP

Apple

Jun ’22

I was hoping to have only a simple command line tool, not embedded inside an app.

I’m sorry but I don’t understand this. Perhaps you could walk me through a typical user-level scenario of what you’re trying to achieve?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

devfunshark OP

Jun ’22

Well, let's imagine I have a python script that does something easy to do in python, but hard in swift : script.py

I would like to run this python script on a macOS system, but to protect the python process against tempering, I would like this python process to have a hardened runtime.

In the link you sent, there is a fully fledged app, in addition to the script. So I was wondering if there was a simpler way to do this, without the full app.

Also, with the technique described in the link, I don't know if the runtime of command-line tool itself is actually protected with hardened runtime?

0