MacOS – How to ensure Slack runs safely in sandbox

mac-appstoremacosprivacysandboxSecurity

For work I use my personal laptop and I am required to run Slack to keep in contact with coworkers however it occurs to me that this could potentially be used as an invasive surveillance tool unless it is forced to run in a sandbox.

For instance what if it were allowed to scan my file system, including any attached USB thumb drives, and what if it were allowed to take screenshots? What if there is a built-in keylogger? I need to make sure that this software is not being used for improper purposes. We all know how power can be abused, and how even a little bit of power over people can tempt a weak person to do bad things.

IIRC I downloaded it using the Mac App Store.

Questions:

Does anyone know how I can determine what the default sandbox setting of this app is?

If the app is bypassing the sandboxing mechanism how do I nevertheless enforce sandboxing?

Has anyone here managed to detect open files (using lsof on the command line) that Slack was accessing, that might indicate suspicious activity?

Best Answer

Slack is a well-known chatting tool and I am yet to hear it does any surveillance. Also, every single Mac app which is submitted into App Store after June 1 of 2012 must have sandboxing implemented or it won't be approved.

Additionally, no app is able to access your computer outside of its limits unless you give it your root password (Slack does not ask for it).

If you still don't feel safe, open Monitor application in Utilities, select Slack app in the list, press (i) button on the toolbar and select "open files and ports" tab. No file will go away.

All the above means that Slack already runs in the Sandbox. In theory (and I stress on "theory") sandbox can be bypassed, but I highly doubt such a serious company would do it first, and second - such app is very unlikely to be on the AppStore.

Related Solutions

MacOS – Sandbox admin privileges

The App can have read/write access to a location if it gets your permission using an entitlement as part of the App Sandbox, in other words this is how its suppose to work. The App is code-signed and trusted, its asking your permission, in theory all should be good.

As noted in the Mac Technology overview:

App Sandbox

Introduced in OS X v10.7, App Sandbox provides a last line of defense against stolen, corrupted, or deleted user data if malicious code exploits your app. App Sandbox also minimizes the damage from coding errors. Its strategy is twofold:

App Sandbox enables you to describe how your app interacts with the system. The system then grants your app only the access it needs to get its job done, and no more.

App Sandbox allows the user to transparently grant your app additional access by using Open and Save dialogs, drag and drop, and other familiar user interactions.

Specifically a developer can implement the following entitlement as noted here in Enabling App Sandbox, this is exactly what you described in your question, so this is probably the entitlement that the A/V program developer had utilized to obtain just read and write access.

com.apple.security.files.user-selected.read-write

Read/write access to files the user has selected using an Open or Save dialog

Note that this is not the same as true administrator user, since the program would not be granted the execute privilege.

MacOS – How to enforce sandbox rules for the particular app

Yes, you can change the binary, or even change the Info.plist, but like changing the binary you make will need to do this again each time the app is updated. There's no way to do this without changing the app in a way that won't be overwritten when it's updated.

You can automatically make your changes with a Launch Agent.
Save the following in ~/Library/LaunchAgents as com.yourname.youragent.plist, then run launchctl load ~/Library/LaunchAgents/com.yourname.youragent.plist.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.yourname.youragent</string>
        <key>OnDemand</key>
        <true/>
        <key>Program</key>
        <string>cp</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Users/grgarside/test/MyApp</string>
            <string>/Applications/MyApp.app/Contents/MacOS/</string>
        </array>
        <key>WatchPaths</key>
        <array>
            <string>/Applications/MyApp.app/Contents/MacOS/MyApp</string>
        </array>
    </dict>
</plist>

The above script will watch the WatchPaths for any modifications (in this case, it's watching the binary for an app) and will run cp to copy your binary to the app in /Applications.

Best Answer

Related Solutions

MacOS – Sandbox admin privileges

MacOS – How to enforce sandbox rules for the particular app

Related Question