seatbelt-sandboxer

To generate a macOS Seatbelt profile, specify the application subcommands you want sandboxed and the runtime working directory path. The tool produces a deny-by-default configuration with precise allow rules for required filesystem, network, and process operations.

A deny-by-default sandbox profile blocks all application access except explicitly allowed operations. You need one for macOS security hardening to reduce the blast radius of application compromise by enforcing strict allowlist-based permission scoping.

You add filesystem and network permissions to a Seatbelt sandbox configuration by defining precise allow rules with path filters. This includes scoped access for file reads, writes to working directories, and selectable network behavior to preserve app functionality.

Yes, you can restrict macOS binaries with Seatbelt profiles while preserving functionality by iteratively testing sandbox failures and expanding permissions. The workflow involves tightening allow rules for process spawning and IPC operations until the application works correctly.

An app hangs or fails to read files after applying a Seatbelt sandbox profile because the deny-by-default configuration blocks required filesystem metadata or content reads. You must iteratively add specific allow rules for the blocked working directory paths.

The best way to apply defense-in-depth isolation to macOS applications is generating minimal Seatbelt profiles that scope process, file, and network permissions. This allowlist-based approach safely restricts capabilities while maintaining required runtime functionality.