{"version":"1.0.122","anchor":"enhanced-sandbox-security-macos","canonical_anchor":"enhanced-sandbox-security-macos","heading":"Enhanced Sandbox Security (macOS)","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.122\/e\/enhanced-sandbox-security-macos","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.122","markdown":"### Enhanced Sandbox Security (macOS)\n\n**What changed:** macOS sandbox policies rewritten based on Chrome's security model, replacing broad wildcards with explicit whitelists\n\n**How it works now:**\n\n- **Process permissions:** Only allows `process-exec`, `process-fork`, and same-sandbox operations (previously allowed all process operations)\n- **Mach IPC:** Restricts to 9 specific Apple system services instead of allowing all Mach operations\n- **IOKit access:** Limited to specific device classes (IOSurfaceRootUserClient, RootDomainUserClient) instead of all IOKit operations\n- **Sysctls:** Whitelists ~45 specific hardware\/kernel information sysctls instead of allowing all reads\n- **File I\/O:** Specific device files only (\/dev\/null, \/dev\/random, etc.)\n\n**Details:**\n\n- Follows principle of least privilege\n- Based on Chromium's battle-tested sandbox implementation\n- Breaking change: Commands relying on unrestricted system access may fail\n- Unix socket configuration changed: `allowUnixSockets` now only accepts array of paths (boolean values removed)\n- **Evidence**: `kc4() at line 370411` (new profile generator replacing `eb6() at line 374940` in v1.0.120)"}