Skip to content


Subversion checkout URL

You can clone with
Download ZIP
sandbox files for some applications running on osx for more security
Latest commit 5d7fb82 @pansen Update README.rst


Mac OS Sandbox Profiles

To prevent application security issues to compromise your system, it is possible to run them inside a sandbox in OSX. I started writing some sandbox files.



To let any application run inside the sandbox, there has to

  • exist a sandbox file, that grants enough permissions
  • be modified to original application package, to "bridge" the applications binary to a sandboxed version.

The first point is pretty easy to build, the second point is a bit insecure as an application could overwrite our "bridged starter" via update. If there is a good idea in someones' mind, let me know.


Howto Do

Checkout the repo to /Users/Shared/macos-sandbox-profiles

Do the following actions to protect Skype and Firefox (which is currently provided here). Further applications will be supported the same way.

cd /Applications/
sudo mv firefox-bin firefox-bin.real
sudo ln -sf /Users/Shared/macos-sandbox-profiles/bin/firefox-bin .

cd /Applications/
sudo mv Skype Skype.real
sudo ln -sf /Users/Shared/macos-sandbox-profiles/bin/Skype .


  • Currently its not possible to allow firefox to start e.g. to display pdf files out of the browser. There has to be made a download in before, which is not as convenient as it could be. Please tell me how to do it, if you know.
Something went wrong with that request. Please try again.