macOS sandbox action modifiers, filters, and operations

action-modifiers.scm

;; Current as of macOS 15.1

(with send-signal …)
(with errno …)
(with report)
(with no-report)
(with no-sandbox)
(with grant)
(with sip-override)
(with no-times)
(with user-approval …)
(with message …)
(with default-sandbox …)
(with assign-storage-class …)
(with authority)
(with telemetry)
(with telemetry-backtrace)
(with no-approval-prompt)
(with enable-state-flag …)
(with no-storage-class)
(with autobox-telemetry)
(with restrictive-default)
(with message-filter …)

filters.scm

;; Current as of macOS 15.1

(%entitlement-boolean …)
(%entitlement-is-bool-true …)
(%entitlement-is-present …)
(%entitlement-load …)
(%entitlement-string …)
(ancestor-signing-identifier …)
(appleevent-destination …)
(boot-arg …)
(codesigning-operation …)
(control-name …)
(csr …)
(datavault-disk-filter …)
(device-conforms-to …)
(device-major …)
(device-minor …)
(extension …)
(extension-class …)
(extension-path-ancestor …)
(fcntl-command …)
(file-attribute …)
(file-mode …)
(fileprovider-syncroot-path …)
(filesystem-name …)
(fsctl-command …)
(global-name …)
(host-special-port …)
(info-type …)
(ioctl-command …)
(iokit-connection …)
(iokit-method-number …)
(iokit-property …)
(iokit-registry-entry-attribute …)
(iokit-registry-entry-class …)
(iokit-trap-number …)
(iokit-usb-interface-class …)
(iokit-usb-interface-subclass …)
(iokit-user-client-type …)
(ipc-posix-name …)
(kas-info-selector …)
(kernel-mig-routine …)
(kext-bundle-id …)
(local …)
(local-name …)
(mac-policy-name …)
(mac-syscall-number …)
(mach-derived-port-role …)
(mach-exception-behavior …)
(mach-exception-type …)
(machtrap-number …)
(memorystatus-control-command …)
(message-name …)
(message-number …)
(mount-relative-path …)
(mount-root-path …)
(necp-client-action …)
(notification-name …)
(notification-payload …)
(nvram-variable …)
(path …)
(persona-type …)
(preference-domain …)
(privilege-id …)
(process-attribute …)
(process-path …)
(profile-flag …)
(reboot-flags …)
(remote …)
(require-ancestor-with-entitlement …)
(require-responsible-binary-with-entitlement …)
(require-target-with-entitlement …)
(right-name …)
(rootless-boot-device-filter …)
(rootless-disk-filter …)
(semaphore-owner …)
(signal-number …)
(signing-identifier …)
(snapshot-name …)
(socket-domain …)
(socket-option-level …)
(socket-option-name …)
(socket-protocol …)
(socket-type …)
(state-flag …)
(storage-class …)
(storage-class-extension …)
(syscall-number …)
(sysctl-name …)

sandbox-operations.scm

;; Current as of macOS 15.1

appleevent-send
authorization-right-obtain
boot-arg-set
darwin-notification-post
default
default-message-filter
device*
device-camera
device-microphone
distributed-notification-post
dynamic-code-generation
file*
file-chroot
file-clone
file-ioctl
file-issue-extension
file-link
file-lock
file-map-executable
file-mknod
file-mount
file-mount-update
file-read*
file-read-data
file-read-metadata
file-read-xattr
file-revoke
file-search
file-test-existence
file-unmount
file-write*
file-write-acl
file-write-create
file-write-data
file-write-finderinfo
file-write-flags
file-write-mode
file-write-owner
file-write-setugid
file-write-times
file-write-unlink
file-write-xattr
fs-quota*
fs-quota-get
fs-quota-off
fs-quota-on
fs-quota-set*
fs-quota-set-limits
fs-quota-set-usage
fs-quota-stat
fs-quota-sync
fs-rename
fs-snapshot*
fs-snapshot-create
fs-snapshot-delete
fs-snapshot-mount
fs-snapshot-revert
generic-issue-extension
hid-control
iokit*
iokit-async-external-method
iokit-external-method
iokit-external-trap
iokit-get-properties
iokit-issue-extension
iokit-open*
iokit-open-service
iokit-open-user-client
iokit-set-properties
ipc*
ipc-posix*
ipc-posix-issue-extension
ipc-posix-sem*
ipc-posix-sem-create
ipc-posix-sem-open
ipc-posix-sem-post
ipc-posix-sem-unlink
ipc-posix-sem-wait
ipc-posix-shm*
ipc-posix-shm-read-data
ipc-posix-shm-write*
ipc-posix-shm-write-create
ipc-posix-shm-write-data
ipc-posix-shm-write-unlink
ipc-sysv*
ipc-sysv-msg
ipc-sysv-sem
ipc-sysv-shm
job-creation
lsopen
mach*
mach-bootstrap
mach-cross-domain-lookup
mach-derive-port
mach-host*
mach-host-exception-port-set
mach-host-special-port-set
mach-issue-extension
mach-kernel-endpoint
mach-lookup
mach-message-send
mach-priv*
mach-priv-host-port
mach-priv-task-port
mach-register
mach-task*
mach-task-exception-port-set
mach-task-inspect
mach-task-name
mach-task-read
mach-task-special-port*
mach-task-special-port-get
mach-task-special-port-set
managed-preference-read
necp-client-open
network*
network-bind
network-inbound
network-outbound
nvram*
nvram-delete
nvram-get
nvram-set
opendirectory-user-modify
process*
process-codesigning
process-exec*
process-exec-interpreter
process-exec-update-label
process-fork
process-info*
process-info-codesignature
process-info-dirtycontrol
process-info-ledger
process-info-listpids
process-info-pidfdinfo
process-info-pidfileportinfo
process-info-pidinfo
process-info-rusage
process-info-setcontrol
process-legacy-codesigning*
process-legacy-codesigning-blob-get
process-legacy-codesigning-cdhash-get
process-legacy-codesigning-entitlements-blob-get
process-legacy-codesigning-entitlements-der-blob-get
process-legacy-codesigning-identity-get
process-legacy-codesigning-status*
process-legacy-codesigning-status-get
process-legacy-codesigning-status-set
process-legacy-codesigning-teamid-get
process-legacy-codesigning-text-offset-get
pseudo-tty
qtn-user
sandbox-check
signal
socket-ioctl
socket-option*
socket-option-get
socket-option-set
storage-class-map
syscall*
syscall-mach
syscall-mig
syscall-unix
sysctl*
sysctl-read
sysctl-write
system*
system-acct
system-audit
system-automount
system-debug
system-fcntl
system-fsctl
system-info
system-kas-info
system-kext*
system-kext-load
system-kext-query
system-kext-unload
system-mac*
system-mac-label
system-mac-syscall
system-memorystatus-control
system-necp-client-action
system-nfssvc
system-package-check
system-privilege
system-reboot
system-sched
system-set-time
system-socket
system-suspend-resume
system-swap
user-preference*
user-preference-read
user-preference-write
xpc-message-send