Hi Team, If I want to create a command line app in swift which needs to be invoked using sudo, will I be able to sandbox this app?
Is Sandboxing possible for Command line app run with sudo
Thank you for your post. Is your question related to submitting a terminal application to the App Store?
I believe but I have been wrong before, the App Sandbox is enforced at the kernel level. Even if you execute your application as root using sudo, the kernel will still enforce the sandbox restrictions. If your application requires sudo to access system files (such as /etc), read other users’ data, or bind to low ports, the sandbox should block these actions regardless of whether the application is running as root.
If this is a standalone command-line tool intended to be run by administrators via sudo, simply do not enable the App Sandbox capability. Command-line tools are not required to be sandboxed unless they are being bundled within a sandboxed Mac App Store application.
Additionally, please review the types of applications accepted at the store. Is this a Mac App?
If your Swift application genuinely requires root privileges to function, do not want to sandbox it. If your intention is to submit it to the App Store, well, a terminal application is not an option in this case, as it appears.
Thanks,
Albert WWDR
Like Albert, I’m curious as to what you’re actual goal is here. Can you take a step back and explain more about the big picture here?
Some random thoughts:
- You can’t distribute a command-line tool in the App Store, so you have the option of disabling App Sandbox. Is there a specific reason you need to enable it?
- It is possible to sandbox a command-line tool, but it’s quite unusual.
- It is possible for combine App Sandbox and running as root [1] but, again, it’s quite unusual.
- When you run a tool using
sudoit ends up in a mixed execution environment. Trying to combine that with App Sandbox puts you fare off the beaten path.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] One place you see this is when you package a Network Extension as a sysex.