CODEWITHSUNDEEP
macosdarwin
Alexander Presber
Alexander Presber

Reputation: 6635

sandbox-exec: deny network access but allow socket

I am using MacOSX's sandbox-exec to deny network access for a command (like e.g. described in this article).

Unfortunately this also seems to deny MySQL access to it's socket:

Can't connect to local MySQL server through socket '/tmp/mysql.sock'

The profile-file for sandbox-exec is this:

(version 1)
(allow default)
(deny network*)

Is there a way to restrict only TCP/internet network access but leave socket access unchanged?

Upvotes: 1

Views: 959

Answers (1)

Alexander Presber
Alexander Presber

Reputation: 6635

Found out. The profile file has to contain (allow network-outbound (to unix-socket)):

(version 1)
(allow default)
(deny network*)
(allow network-outbound (to unix-socket))

Upvotes: 2

Related Questions