seatbelt-sandboxer

To generate a macOS Seatbelt sandbox profile, specify the target executable's required file, network, process, and IPC operations to produce a minimal allowlist .sb configuration for application isolation.

An allowlist-based Seatbelt profile is a minimal macOS sandbox configuration that explicitly permits only necessary file, network, and IPC operations. You need one to isolate untrusted applications and restrict their system access.

You test and refine a generated .sb sandbox profile by iteratively running the target application through the sandbox-exec command, verifying operations, and updating the configuration until the application functions correctly under restriction.

Yes, you can restrict network and file system access by generating a minimal Seatbelt profile that defines strict allowlist rules for permitted process, file, network, and IPC operations based on application requirements.

The main limitation of using Seatbelt profiles is that generating a functional configuration requires iterative testing and refinement with sandbox-exec to ensure the sandboxed application retains access to only its strictly necessary system resources.