go-macos-sandbox

module

v0.2.0 Latest Latest Go to latest Published: Jul 9, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/deploymenttheory/go-macos-sandbox

Links

Open Source Insights

README ¶

go-macos-sandbox

Standalone Go module for inspecting and working with the macOS App Sandbox: entitlement introspection, code-signature inspection, security-scoped bookmarks, and sandbox container/violation discovery. Built on go-bindings-macosplatform; darwin-only (every file is //go:build darwin).

It exists so multiple consumers (e.g. go-macos-observability, guestweave-macos) etc can share these macOS sandbox primitives instead of each re-implementing them.

Packages

Package	Purpose
`entitlements`	Well-known App Sandbox entitlement key constants + shared error vocabulary
`process`	Sandbox status & entitlements for the current process / any PID (csops(2) + SecTask)
`codesign`	Code signature & embedded entitlements of on-disk binaries; helper-tool verification
`bookmark`	Create/resolve security-scoped bookmarks for user-selected files
`searchpath`	Standard container directories (Documents, Application Support, ...)
`container`	Discover & parse App Sandbox containers and `Container.plist`
`violation`	Read sandbox violation (deny) records from the unified log

Internal packages (internal/cfconv, internal/plistutil, internal/procpath) are implementation details and not part of the public API.

Dependency graph (acyclic)

entitlements (leaf)
  ← internal/cfconv ← codesign ← process (← internal/procpath)
container → entitlements, internal/plistutil
bookmark · searchpath · violation → SDK only

Usage

import "github.com/deploymenttheory/go-macos-sandbox/process"

sandboxed, err := process.IsSandboxedSelf()

Requirements

macOS (darwin), cgo-free — uses purego via the bindings SDK.
Go 1.26+.

Directories ¶

Path	Synopsis
bookmark Package bookmark creates and resolves macOS security-scoped bookmarks, which let a sandboxed app persist and regain access to user-selected files and folders across launches.	Package bookmark creates and resolves macOS security-scoped bookmarks, which let a sandboxed app persist and regain access to user-selected files and folders across launches.
codesign Package codesign inspects the code signature and embedded entitlements of on-disk Mach-O binaries and app bundles via the Security framework's SecStaticCode APIs, including verification of embedded sandboxed helper tools.	Package codesign inspects the code signature and embedded entitlements of on-disk Mach-O binaries and app bundles via the Security framework's SecStaticCode APIs, including verification of embedded sandboxed helper tools.
container Package container discovers macOS App Sandbox container directories (system and per-user) and parses their Container.plist metadata, plus app-group and iCloud ubiquity container paths.	Package container discovers macOS App Sandbox container directories (system and per-user) and parses their Container.plist metadata, plus app-group and iCloud ubiquity container paths.
entitlements Package entitlements defines well-known macOS App Sandbox entitlement keys (mirroring Apple's capability plist keys) and the shared entitlement error vocabulary used across go-macos-sandbox.	Package entitlements defines well-known macOS App Sandbox entitlement keys (mirroring Apple's capability plist keys) and the shared entitlement error vocabulary used across go-macos-sandbox.
internal
cfconv
plistutil Package plistutil provides minimal plist decoding and value coercion helpers.	Package plistutil provides minimal plist decoding and value coercion helpers.
procpath
process Package process inspects App Sandbox status and code-signing entitlements for the current process and for arbitrary PIDs.	Package process inspects App Sandbox status and code-signing entitlements for the current process and for arbitrary PIDs.
searchpath Package searchpath resolves standard container directories (Documents, Application Support, Caches, Downloads, ...) inside the App Sandbox, wrapping FileManager.URLForDirectory(inDomain:appropriateFor:create:).	Package searchpath resolves standard container directories (Documents, Application Support, Caches, Downloads, ...) inside the App Sandbox, wrapping FileManager.URLForDirectory(inDomain:appropriateFor:create:).
violation Package violation reads App Sandbox violation (deny) records from the macOS unified log (subsystem com.apple.sandbox.reporting, category violation).	Package violation reads App Sandbox violation (deny) records from the macOS unified log (subsystem com.apple.sandbox.reporting, category violation).

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL