macOS App Sandboxing: How It Protects Users

macOS app sandboxing is a security technology that confines a third-party app to a strict set of permissions, so even if the app is compromised, it can only access the files, network, and system resources you explicitly allow. This guide explains how sandboxing works, what it protects you from, and how to verify that an app is sandboxed.

What You’ll Need

• A Mac running macOS 10.7 (Lion) or later (sandboxing is enforced for Mac App Store apps since 2012).
• An app you suspect may or may not be sandboxed (for verification steps).
• Terminal (located in /Applications/Utilities/) for checking app entitlements.

Step-by-Step

1. Understand the core concept. A sandboxed app runs in its own isolated container—a hidden folder with a unique ID. The app can read and write only within this container unless you grant additional access via user-approved prompts (like choosing a file in an Open dialog) or system-provided entitlements (like network client access).
2. Know the default protections. When an app is sandboxed, it is automatically denied: writing to most locations outside its container, reading files from other apps’ containers, accessing the network (unless the “com.apple.security.network.client” entitlement is present), sending keystrokes to other apps, and controlling other processes. This limits the blast radius of a compromised app.
3. Check if an app is sandboxed (method 1: Activity Monitor). Open Activity Monitor (in /Applications/Utilities/). Select the app’s process in the list, click the “i” button in the toolbar, and look for “Responsible Process.” If the app is sandboxed, the responsible process will be the app itself (not a parent process like launchd). A more direct way: in the same info window, look for the “Sandbox” field—it will say “Yes” for sandboxed apps.
4. Check if an app is sandboxed (method 2: Terminal). Open Terminal and run: codesign -d --entitlements :- /Applications/AppName.app (replace AppName with the actual app). If the output contains a key like com.apple.security.app-sandbox with a value of true, the app is sandboxed. If you see code object is not signed or no entitlements, it is not sandboxed.
5. Understand how user approval works. When a sandboxed app needs to access a file outside its container, macOS shows a standard Open/Save dialog. Once you select a file, the app gains access to that specific file (or folder if you select a folder) until it quits. This is called “powerbox”—the system mediates the access, not the app itself.
6. Know what sandboxing does NOT protect. Sandboxing does not prevent an app from using your CPU or memory, nor does it stop an app from displaying malicious UI. It also does not protect against apps that legitimately request broad entitlements (like network access) and then misuse them. Always review the permissions an app requests when you first run it.
7. Verify entitlements for network access. If you are concerned about an app phoning home, check its entitlements. Look for com.apple.security.network.client (allows outgoing connections) or com.apple.security.network.server (allows incoming connections). If neither is present, the app cannot access the network.
8. Test the sandbox in practice. Open a sandboxed app (like TextEdit from the App Store) and try to save a file to /Library (a system folder). You will not be able to—the app can only save to your user folders or its container unless you use the dialog to navigate to a location you have permission to write to.

Common Mistakes

• Assuming all Mac App Store apps are sandboxed. While Apple has required sandboxing for all new Mac App Store submissions since 2012, some older apps may have been grandfathered. Always check with the codesign command.
• Confusing sandboxing with Gatekeeper. Gatekeeper checks the app’s signature and notarization status before allowing it to run. Sandboxing is a separate runtime restriction. An app can pass Gatekeeper without being sandboxed.
• Thinking sandboxing stops all malicious behavior. A sandboxed app can still steal your passwords if you type them into its UI, or encrypt your files if you grant it access to your Documents folder. Sandboxing limits system access, not user trust.
• Believing that a sandboxed app cannot crash your system. A sandboxed app can still consume all your RAM or cause a kernel panic via a bug, though it cannot intentionally modify system files.

Tips

• Prefer apps from the Mac App Store for the highest baseline of security—they are required to be sandboxed and follow strict privacy guidelines.
• When downloading apps from outside the store, check their sandbox status before running them. If an app is not sandboxed, be extra cautious about the permissions it asks for.
• Use the “Open” dialog to grant file access on a per-file basis rather than granting full disk access to an app. For example, if an app only needs one document, select that file, not the whole folder.
• Regularly review the Privacy pane in System Settings (or System Preferences on older macOS) to see which apps have been granted access to sensitive data like Contacts, Photos, or Full Disk Access. Revoke any that you no longer use.

Troubleshooting

• An app cannot save a file where you want. This is likely due to sandboxing. Use the Save dialog to navigate to a location you have permission to write to (like your Documents folder). If you need to save to a specific folder, try saving to the Desktop and then moving the file manually.
• An app asks for access to a folder repeatedly. Some sandboxed apps do not remember your permission after they quit. This is a known limitation. You can either re-grant access each time or, if the app is from the Mac App Store, check for an update that might fix the issue.
• You cannot drag a file into a sandboxed app. Dragging a file into a sandboxed app’s window usually grants temporary access to that file, but if the app does not support it, use File > Open instead.
• An app crashes after being granted access. This is rare but can happen if the app was not designed to handle sandboxed file access. Try quitting the app and reopening it, or contact the developer.

Frequently Asked Questions

Is every app from the Mac App Store sandboxed?

Yes, since 2012, Apple has required all new Mac App Store submissions to be sandboxed. Existing apps that were already on the store were given time to comply, but now virtually all are sandboxed.

Can a sandboxed app read my personal files?

Only if you grant it access via an Open/Save dialog, or if you gave it permission in the Privacy pane (e.g., Contacts, Photos). By default, it can only read its own container.

Does sandboxing affect app performance?

Sandboxing adds minimal overhead because the system mediates access at the kernel level. Most users notice no difference.

Can I turn off sandboxing for an app?

No, sandboxing is a property of the app’s code signature. You cannot disable it without re-signing the app, which would break its signature and cause macOS to refuse to run it (or require you to bypass Gatekeeper).

How do I know if an app is sandboxed before I download it?

For Mac App Store apps, the store listing does not explicitly say, but you can assume it is sandboxed. For third-party apps, check the developer’s website or use the codesign command after downloading.

What happens if a sandboxed app is hacked?

The attacker is confined to the app’s container and the permissions you granted. They cannot access other apps’ data or system files, which significantly limits the damage.

Related

• Fix Error 0x8024800c in Windows 11
• AI Accelerator vs GPU: What’s the Difference?
• Alexa Find Missing Phone: How to Use It