Enhanced Sandbox Security (macOS)

What changed: macOS sandbox policies rewritten based on Chrome's security model, replacing broad wildcards with explicit whitelists

How it works now:

• Process permissions: Only allows process-exec, process-fork, and same-sandbox operations (previously allowed all process operations)
• Mach IPC: Restricts to 9 specific Apple system services instead of allowing all Mach operations
• IOKit access: Limited to specific device classes (IOSurfaceRootUserClient, RootDomainUserClient) instead of all IOKit operations
• Sysctls: Whitelists ~45 specific hardware/kernel information sysctls instead of allowing all reads
• File I/O: Specific device files only (/dev/null, /dev/random, etc.)

Details:

• Follows principle of least privilege
• Based on Chromium's battle-tested sandbox implementation
• Breaking change: Commands relying on unrestricted system access may fail
• Unix socket configuration changed: allowUnixSockets now only accepts array of paths (boolean values removed)
• Evidence: kc4() at line 370411 (new profile generator replacing eb6() at line 374940 in v1.0.120)