Our (sandboxed, distributed through the Mac App Store) app can optionally run as a CLI tool, to allow users to use it in scripts and other automation contexts. One of the usecases involves being a wrapper for the ssh command, but the ssh binary is not able to enable raw mode for stdin due to a sandbox violation (bug report).
As a reduced example, I've created https://github.com/mihaip/sandboxed-cli-test, which has a minimal C program that uses tcsetattr to set attributes on stdin. That fails, and sandboxd logs to the console Sandbox: SandboxedCLI(30110) deny(1) file-ioctl /dev/ttys012. If I disable sandboxing on the binary then it works as expected.
Looking through the sandbox profiles on /System/Library/Sandbox/Profiles, I'm not seeing cases where file-ioctl is enabled on /dev/tty. Are we out of luck, or is there a workaround?
Sorry I missed this when you first posted it. I’m not sure how that happened, although it was during the height of the WWDC season so it might’ve just slipped through the cracks )-:
Anyway, another developer pinged me about it via a different channel, so I thought I’d reply here. Unfortunately I don’t see a good way around this. That system log entry you quoted makes it pretty clear that this is being explicitly blocked by the sandbox, and I’m not aware of any alternative path.
I think we already have a bug on file about this (FB25065427) but, presuming that’s not your bug, I recommend that you file your own bug about this. There are a couple of reasons that this is warranted:
- Pseudo-terminals are complex, and your bug will let you express your specific requirements.
- You should also explain your user-level use case. That is, what your product does and what user-level limitations are caused by the sandbox restriction.
The second bit is important because I think your use case is different from the use case proposed by the other developer I’ve been talking to, and it’s important that the Apple folks looking into this get the full picture.
If you do file a bug, please reply here with the bug number, just for the record.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
