Sandbox Detector

Building an Apple Sandbox Detector on macOS in C

INTRO

In the article about various binary protections on macOS, we learned how to identify sandboxing through app entitlements using codesign:

Snake&Apple III — Checksec

However, this method assumes everything works as expected on launch and is only a static check. In this post, we will learn how to ensure the app we launched runs in sandbox mode by knowing the Process ID (PID).

For this reason, we will touch the surface of the Sandbox userland APIs made available to us by libsystem_sandbox.dylib, though undocumented.

There will also be an example of using low-level BSD sysctl to query the kernel to get the process information and how to build a C program from undocumented decompiled code. Enjoy reading!

Detecting Sandbox

We learned how to detect if App Sandbox is used from the app entitlement com.apple.security.app-sandbox in — Snake&Apple III — Checksec: