I used Norton's iAntivirus app from the Mac App Store to scan my entire hard drive. As expected, it presented me with an Open dialog at the root of my hard drive. I clicked "Open" and let it scan. This caused me to wonder... if the user opens a directory in the Open dialog, does this give the sandboxed application access to all of the contents of the folder, even if the specific user may not have permission to access some of them?
migrated from stackoverflow.com Mar 18 at 7:19
This question came from our site for professional and enthusiast programmers.
A sandbox readonly or read-write entitlement is an additional requirement that must to access the filesystem when running under the sandbox. For any item outside of the applications container then the application must be granted a readonly or read-write entitlement - either statically via the entitlements compiled into the application or dynamically by the user selecting a file or folder - and the user must have the appropriate filesystem access right to the filesystem item.
For example if the user grants your application read-write access to another users Public folder using a standard file dialog, that does not change that the user can only read the contents of Public and write to the contained Drop Box folder.
Subject to the requirement for an appropriate filesystem access right, a user granting sandbox access via a standard file dialog to a folder is granting access to the whole file hierarchy rooted at that folder.
The sandboxed application is only given access to what the user can access. So if the user opens a folder in an Open dialog that they do not have permission to access, the app will not be able to open it, either. I tested this on OS X 10.8.3. I gave my user No access permissions to a folder on my desktop, opened the desktop in an Open dialog, and then attempted to write a file into the restricted folder. The action failed with the error, You don’t have permission to save the file “file” in the folder “restricted”.
My main concern was that sandboxing is managed by the sandbox daemon,