Make the macOS sandbox stricter to workaround a macOS bug (fixes ocam…

…l#4389)
kit-ty-kate · Sep 2, 2021 · 94f1aad · 94f1aad
1 parent efd6b31
commit 94f1aad
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/state/shellscripts/sandbox_exec.sh b/src/state/shellscripts/sandbox_exec.sh
@@ -4,6 +4,7 @@ set -ue
 POL='(version 1)(allow default)(deny network*)(deny file-write*)'
 POL="$POL"'(allow network* (remote unix))'
 POL="$POL"'(allow file-write* (literal "/dev/null") (literal "/dev/dtracehelper"))'
+POL="$POL"'(deny file-read* (regex #"^(/private)?/var/folders/"))'
 
 add_mounts() {
     if [ -d "$2" ]; then