A Quick Data Point On Sandboxes

Thomas Ptacek | November 1st, 2007 | Filed Under: Apple, Uncategorized

Sandboxes are implemented via the “seatbelt” kext. You can run “lipo” on “seatbelt” to extract the i386 kernel module, and and pull it into a disassembler. Ralf and I are doing that now. Here’s what we now know:

Sandboxes are built, at least in part, on the new security/ subsystem of XNU (the source is available for that), which is derived from TrustedBSD (and, presumably, SEDarwin).

The Sandbox/seatbelt policy layer itself is Apple-proprietary, and I don’t think the source is available; more as I figure out more from the binary.

3 Comments so far

  • bob

    November 2nd, 2007 11:41 am

    Sandboxes seem really good, but some of their content seems embarassing to Apple.

    On Mac OS X 10.5 Server, ntpd is started thru ntpd-wrapper (/usr/libexec). The wrapper contains:

    #!/bin/sh
    PATH=/usr/sbin:/usr/bin:/bin

    ipconfig waitall
    ntpdate -bvs

    # Un-comment the following line to run ntp with a sandbox profile.
    # Sandbox profiles restrict processes from performing unauthorized
    # operations; so it may be necessary to update the profile
    # (/usr/share/sandbox/ntpd.sb) if any changes are made to the ntp
    # configuration (/etc/ntp.conf).
    #sb=/usr/bin/sandbox-exec -f /usr/share/sandbox/ntpd.sb

    exec $sb /usr/sbin/ntpd -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift

    Oh. Ok, no sendbox for ntpd then. The comments in the sandbox config files are also hilarious :

    (allow sysctl-read)
    ; can this be
    ; (allow network* (tcp to “0.0.0.0/0:42″))
    ; (allow network* (udp to “0.0.0.0/0:42″))
    ; or does named do other network traffic? There is a control port on
    ; modern named isn’t there?
    (allow network*)

    etc…

  • Rosyna

    November 6th, 2007 8:09 pm

    Wanted to add this point quickly. All files created by Safari (and iCal) are automatically under quarantine by the system. Oddly, Mail.app files are not.

  • Ian

    December 4th, 2007 1:04 pm

    Is there any reliable way to build a general purpose sandbox for OS X off of this - this seems the critical question here. I use Sandboxie in Windows and would love the same functionality for Leopard. Sandboxie goes further in that is copies files an app requests into the sandbox so it thinks it is working in the filesystem when in fact it is not.

    I don’t care too much that Safari is or isn’t sandboxed, but I *do* want to make sure an app I downloaded cannot wreak havoc.

    • Leave a reply