Entitlements and SandBoxing


This week we have finished porting all our products to 64-bits. We also updated the App Store versions accordingly following Apple new requirements regarding Entitlements and SandBoxing. But do you actually know what Entitlements and SandBoxing are? Even if you are not a programmer it is always interesting to have a small idea about security concepts since we are talking about security.

macOS has supported Sandboxing since OS X Lion, which was released in 2011. The Mac App Store has required apps to be sandboxed since March 2012. Windows does not natively provide app sandboxing, but some apps (such as Microsoft Office programs) can be run in a sandboxed mode. Additionally, several Windows utilities allow you to run apps in a sandbox, preventing them from affecting the system or other applications.

Sandboxing restricts an application’s access to only system resources, including the file system, for which it’s explicitly given access. A sandboxed application is given a code signature to prevent tampering, and a list of system resources it’s allowed to access. This list of system resources is called its entitlements.

Sandboxing is a software management strategy that isolates applications from critical system resources and other programs. It provides an extra layer of security that prevents malware or harmful applications from negatively affecting your system.

Without sandboxing, an application may have unrestricted access to all system resources and user data on a computer. A sandboxed app on the other hand, can only access resources in its own "sandbox." An application's sandbox is a limited area of storage space and memory that contains the only resources the program requires. If a program needs to access resources or files outside the sandbox, permission must be explicitly granted by the system.

For example, when a sandboxed app is installed in macOS, a specific directory is created for that application's sandbox. The app is given unlimited read and write access to the sandboxed directory, but it is not allowed to read or write any other files on the computer's storage device unless it is authorized by the system. This access is commonly granted using the Open or Save dialog box, both of which require direct user input.

While sandboxing provides added security for users, it can also limit the capabilities of an application. For example, a sandboxed app may not allow command line input since the commands are run at a system level. Utilities such as backup programs and keyboard shortcut managers may not be granted sufficient permissions to function correctly. For this reason, some programs cannot be sandboxed.

I remember well when Apple first announced Sandboxing, originally they told Mac App Store developers that their apps would need to implement sandboxing by November 2011. Later that deadline was extended to March 2012. In February 2012, Apple extended that deadline again until June 1. But finally we entered the sandboxed era.

The plus side of sandboxing is that it means, in theory, that your apps will become safer and more trustworthy: Your Mac prevents them from accessing files they shouldn’t access. But that security comes with a price, at least in some cases. Some developers say that sandboxing will force them to remove features from their apps—or, in some cases, to pull them from the Mac App Store entirely.

We managed to sandbox the five applications we were already listing at the App Store, MaxBulk Mailer, iCash, Web Dumper, Loan Calc and FTP Disk. The user will see almost no differences, maybe the applications will sometimes ask for a file or a folder, that's all. With FTP Disk it has been a real challenge! Lots of coding in order to preserve the local file browser. Apple rejected the entitlements and the binaries several times, well, to say the true I was about to give up...

More information on Sandbox here: https://en.wikipedia.org/wiki/Sandbox_(computer_security)

—
Stan Busk - Software Engineer
at www.maxprog.com



Comments

Post a Comment

Popular posts from this blog

The history of iCash and Peggy Première

The iCash development was projected in the late eighties but actually began in the early nineties. The very first version was released by the end of 1991. At the time, it was built to run on Microsoft Windows 3.1 and IBM OS/2. It was coded using the Pascal language. The development of the application continued up to the release of version 2.0 on May 1995. The application wasn't known as iCash but as 'Peggy Première'. Peggy because of the Muppet Show character and the analogy with a piggy bank. And 'Première' refers to the shooting of the first scene of a movie (it means 'First' in french). Peggy Première was supposed to be the best Personal Finance software at that time. Well at least in Spain, where I was leaving. The software was only available in Spanish, not even in french my mother tongue nor English. There were no international sales projected. I spent a decade selling Peggy Première, sending 3'5 floppy disks by mail with cash on delivery as t...
Read more

iCash v3

Maxprog is proud to present a new release of iCash, new version 3.0, available now in English, German, French, Swedish, Italian, Dutch, Spanish and Portuguese on Maxprog website with a lot of new features and improvements Maxprog's iCash is a $30 personal finance and money manager software designed to track incomes, expenses, credits, debts and banks transactions. It offers unlimited categories, multiple accounts creation, multiple currencies, a SQL backend engine, password protection, export/import routines, search functions, and drag & drop support. [Mac OS X , Mac OS 9, Windows] (Available in English, German, French, Swedish, Italian, Dutch, Spanish and Portuguese) iCash is a Personal Finance software, a tool intended to control your money, keeping track of incomes, expenses, credits, debts and Banks transactions for you. As simple as creating the accounts you need and move money between them! You don't even need to know about accounting or even care about it! iCas...
Read more

Maxprog 16th anniversary

Maxprog just turned 16 years old last monday. Believe me or not, it has been a quite pleasant journey. That's very likely because I do what I always wanted. I am a self-taught vocational software developer, I started programming when I was around twelve. In my place computers were like UFOs so no one could help you or even understand you. I have always been fascinated by algoritms (and spinning things), I started very early and never stopped however, being fascinated by something and creating a company are two different things that require very different skill sets. Indeed, in order to be successful creating a company you have to learn about business, you have to create real products, market them, handle payments and after-sales support. Later you may need to hire people, outsource stuff, learn basic accounting etc. Finally you have to fight against your competitors, maintain a good visibility on the internet and take the right decisions in order to continue in business. Most peopl...
Read more