C.W.K.
Stream
Lesson 03 of 04 · published

The Deliberate Un-Sandboxing

~13 min · sandbox-decision, direct-distribution, compensating-boundary

Level 0Lost in Finder
0 XP0/36 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
"Not sandboxing is not the same as not caring. It's trading one boundary you can't use for another one you build and can prove."

Why the Sandbox Doesn't Fit

The macOS App Sandbox is built around user-selected security scopes: an app gets access to a file because the user picked it in an open panel or dragged it in. That model is perfect for a text editor opening one document. It is fundamentally wrong for a file manager, whose entire job is to browse local disks, external drives, and network shares continuously and freely. You cannot ask the user to individually grant every folder on every volume. The sandbox's core assumption breaks against the product's core purpose.

A Deliberate, Documented Choice

So Waygate is deliberately not sandboxed. This is legal precisely because Waygate is directly distributed — not through the Mac App Store, where the sandbox is mandatory. Apple documents both postures; direct distribution may choose the unsandboxed one when the app's purpose requires broad file access. This isn't a shortcut or an oversight; it's a documented architectural decision recorded in the invariants, made because a Finder replacement can't function inside per-file scopes.

The Compensating Boundary Is Strict

Removing the sandbox removes a boundary, so Waygate builds a strict one to compensate. It's signed with a stable internal codesign identity and a stable designated requirement, verified strictly with no ad-hoc fallback. It runs as the user's normal account — no root, no privileged helper. It executes no arbitrary shell, AppleScript, plugin, or downloaded code. Every mutation still crosses the journaled engine. And it surfaces macOS privacy and ACL denials rather than trying to bypass them. If the distribution model or threat assumptions ever change, re-sandboxing is an invariant change, deliberated and documented — never a quiet build-flag flip.

Waygate is deliberately unsandboxed, paired with a strict compensating boundary. A full-volume file manager can't live inside per-file security scopes, and direct distribution permits the choice — but only alongside a stable codesign identity, no root or helper, no arbitrary code execution, journaled mutation, and surfaced (never bypassed) privacy denials. The posture is an invariant, not a build toggle.
Trade-offs are made with eyes open, not avoided. The honest engineering move isn't to pretend the sandbox works here or to go unsandboxed and shrug. It's to name why the sandbox doesn't fit, choose the other posture explicitly, and then spend real effort building the compensating boundary that keeps the choice responsible. A documented trade-off you can defend beats an undocumented default you can't.

Code

Why the sandbox model breaks for a file manager·text
  APP SANDBOX assumes:              A FILE MANAGER needs:
  ----------------------            --------------------
  access granted per user-picked    browse every volume + share
    file / folder                     continuously, freely
  narrow, document-shaped scope      whole-disk, whole-network scope
  great for: an editor, a viewer     impossible to express as
                                       per-file user grants

  Conclusion: Mac App Store sandbox != file manager.
  Direct distribution -> choose unsandboxed, and COMPENSATE.
The compensating boundary (what replaces the sandbox)·text
  - stable internal codesign identity + designated requirement
  - strict bundle verification, NO ad-hoc fallback
  - runs as the normal user: no root, no privileged helper
  - no arbitrary shell / AppleScript / plugin / downloaded code
  - every mutation crosses the journaled FileOperationEngine
  - macOS privacy/ACL denials are SURFACED, never bypassed

  Changing this posture = an INVARIANT change, deliberated + documented,
  never a silent build-flag flip.

External links

Exercise

Name a tool you use that legitimately can't be sandboxed (a backup app, a disk utility, a developer tool). For it, list what the sandbox would have prevented and why that's incompatible with the tool's job. Then sketch the compensating boundary you'd want that tool to have, given it runs with broad access. What would make you trust it?
Hint
Backup apps, disk utilities, and file managers all need broad, continuous access that per-file sandbox scopes can't express — that's the incompatibility. The compensating boundary you'd want mirrors Waygate's: a verifiable code signature, no elevation to root, no arbitrary code execution, an auditable record of what it changed, and honest surfacing of permission denials. Trust comes from a boundary you can inspect, not from an OS cage the tool couldn't wear anyway.

Progress

Progress is local-only — sign in to sync across devices.
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.