Sandbox Mac

sandbox-mac.txt

sandbox() {
  local name="${1:?Usage: sandbox <name>}"
  local workspace="$HOME/workspace/$name"

  mkdir -p "$workspace"

  # Note - sandbox-exec is deprecated on Macs
  sandbox-exec -p "
    (version 1)
    (deny default)
    (allow process-exec)
    (allow process-fork)
    (allow sysctl-read)
    (allow mach-lookup)
    (allow signal)
    (allow file-read*)
    (allow file-write* (subpath \"$workspace\"))
    (allow file-write* (subpath \"/private/tmp\"))
    (allow file-write* (subpath \"/dev/tty\"))
    (allow file-write* (subpath \"/dev/null\"))
  " bash --rcfile "$HOME/.bashrc"
}