Links
- sandbox-exec
- Refer to files in
/usr/share/sandbox/ - The sandbox files are written in TinyScheme
- Keep in mind that bypass isn't difficult. For instance, if you allow subprocess execution, then it's easy to get out of it. Ref: Apple OS X Sandbox Predefined Profiles Bypass