Documentation
¶
Overview ¶
Package sandboxexec is a macOS-only sandbox provider that wraps the `sandbox-exec` binary (a deprecated-but-still-functional CLI shipped with macOS). It runs a child under a Scheme-syntax sandbox profile, which is materialized to a temp file at Prepare time.
Apple has marked sandbox-exec as deprecated for years yet has not removed it; it remains the simplest profile-based isolation available on macOS short of writing a full XPC/launchd/LaunchAgent solution.
Configuration is taken from cwtypes.SandboxSpec.Config:
profile string — full Scheme profile text. Mutually exclusive
with profile_name and profile_file.
profile_name string — apply a built-in named profile via
`sandbox-exec -n <name>` (e.g. "no-network",
"pure-computation"). Mutually exclusive with
profile and profile_file.
profile_file string — path to a profile file on disk. Mutually
exclusive with profile and profile_name.
Exactly one of {profile, profile_name, profile_file} must be set.
macOS-only: New returns ErrUnsupportedPlatform on other GOOS values. `sandbox-exec` must be present on PATH at New() time; otherwise ErrSandboxExecNotFound is returned.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnsupportedPlatform = errors.New("sandboxexec: unsupported platform (macOS only)") ErrSandboxExecNotFound = errors.New("sandboxexec: sandbox-exec binary not found in PATH") )
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// SandboxExecPath overrides the auto-detected sandbox-exec path.
SandboxExecPath string
// TmpDir is the parent directory under which inline profiles are
// materialized. Empty = os.TempDir().
TmpDir string
}
Options configures a sandboxexec.Provider.
Source Files