News for hackers. Stuff that matters.

A comment on macOS Containers v0.0.1. Parent comment

Re:macOS Containers v0.0.1 by diogenes4 on Tuesday September 26, 2023 @09:04AM (#37658677)
I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers.

Wouldn't it be far easier to enumerate what you want an app to access?

[ Parent | on HN ]
Re:macOS Containers v0.0.1 by jmbwell on Tuesday September 26, 2023 @09:57AM (#37659384)
SIP means not messing with the system files, enumerated thusly: /System.

Enumerating what I do want an app to access is handled by Gatekeeper.

[ Parent | on HN ]
Re:macOS Containers v0.0.1 by saagarjha on Tuesday September 26, 2023 @12:42PM (#37661952)
It's actually a larger list available in /System/Library/Sandbox/rootless.conf
[ Parent | on HN ]
Re:macOS Containers v0.0.1 by diogenes4 on Tuesday September 26, 2023 @12:44PM (#37661967)
> SIP means not messing with the system files, enumerated thusly: /System.

...and all its children, which is effectively the entire operating system

> Enumerating what I do want an app to access is handled by Gatekeeper.

Gatekeeper is not capable of this.

[ Parent | on HN ]
Re:macOS Containers v0.0.1 by jmbwell on Tuesday September 26, 2023 @06:18PM (#37666522)
It's among the things Gatekeeper does, isn't it? As configured with PPPC?
[ Parent | on HN ]