Detecting if a running application is sandboxed

Question

Given an application's pid, is there any way, programatically, of detecting if that application is running in an OSX sandbox environment?

Ideally, I'd like to know if there's an API call somewhere, preferably in C, rather than objective-C (for a daemon, so not using Cocoa), but if not, is there any other way of checking?

Answer 1

@Linuxios was right partly right about there being a CoreFoundation call. In fact, there are a few that when combined, can be used to solve this and it's based on the call to SecStaticCodeCheckValidityWithErrors

For anyone that may want, or need to programmatically test for an app being sandboxed can follow this blog .

Also, the full code to the article has been added to Github here .

Answer 2

First you must get the path of the application from the pid, and then you can use the command codesign --display --entitlements - app_path to view all the entitlements. If the app has the entitlements com.apple.security.app-sandbox set to true then it is sandboxed.

You can take a look here .

Answer 3

For detecting the sandbox in Flex/AIR/AS3 you can use the following kludge. The same approach should also work in objc. The only condition under which this would not work would be if the Documents folder were entirely empty. Or you could use any other folder that is off-limits to the sandbox.

            var file:File = File.userDirectory;
            var a:Array = file.nativePath.split("/");
            var userName:String = a[2];
            var docFolder:File = new File("/Users/" + userName + "/Documents/");
            var dirList:Array = docFolder.getDirectoryListing();
            if (dirList.length>0) {
                docDirectoryDisplay.text = "App is NOT sandboxed.";
            } else {
                docDirectoryDisplay.text = "App is sandboxed.";
            }