Generates minimal, allowlist-based macOS Seatbelt sandbox profiles to isolate and secure applications.
The seatbelt-sandboxer skill enables developers and security researchers to harden macOS environments by generating fine-grained Seatbelt (sandbox-exec) configurations. It follows a principle of least privilege, starting with a deny-all default and providing a methodology to iteratively add specific file, network, IPC, and process permissions. This tool is essential for protecting systems against supply chain attacks, isolating untrusted binaries, and implementing robust defense-in-depth security for macOS applications.
主な機能
014,176 GitHub stars
02Support for advanced parameter substitution and regex path matching
03Comprehensive resource categorization for files, network, and Mach IPC
04Iterative testing and validation workflows for profile accuracy
05Allowlist-based access control for enhanced security posture
06Automated generation of minimal-permission .sb profiles
ユースケース
01Hardening macOS applications against potential supply chain vulnerabilities
02Isolating third-party CLI tools or build scripts from sensitive user data
03Creating restricted execution environments for security research and malware analysis
