Slashdot Mirror
Apple To Require Sandboxing For Mac App Store Apps
mario_grgic writes "And so it begins: Apple will require that all Mac apps submitted to the Mac App store stick to strict sandboxing requirements. This means you must ask Apple for read or read/write entitlements for additional folders outside your Application Support folder before your app is approved. There are also restrictions on direct hardware access, communication to processes your app did not start, or even something simple as taking a screenshot. All that is needed after this to turn your Mac into an appliance is to only allow app installations from App Store."
All that is needed after this to turn your Mac into an appliance is to only allow app installations from App Store.
I've made the argument that this is exactly where Apple is headed for a long time now. I'll summarize the responses you're going to get:
Of course, the second that Apple announces that they ARE, in fact, locking down the Mac's too, I suspect you'll see one of two responses (should be interesting to see how it goes):
SJW: Someone who has run out of real oppression, and has to fake it.
Why, at a technical level, is this so bad?
Because... uhh... uhhh.... uuhh... SCREW Apple!!
Haters gotta hate.
I fail to see any problem with this.
I'm actually far happier when apps are clean and well controlled in terms of what they put where, Apple is providing an assurance that this *will* be the case for officially approved apps.
Good on them.
Whether or not they eventually disable applications from outside the App Store is completely irrelevant to this move.
And they're here to make money. There seems to be a large market for people who want pretty appliances with certain "limitations" that work painlessly. Limitations is in quotes because it's a limit to myself and many on Slashdot, but not to most casual users.
So, is this actually unreasonable? Seems to me that if you don't want machines to be pwned, it would be nice to have somebody look over the ap before it starts controlling processes outside its sandbox. Sudo privilege is nice to have, but it's also something you don't want to give away without oversight.
http://www.geoffreylandis.com
You don't ask Apple for anything. You just declare what your application needs from OS to function.
Ever heard of Android? Works the same way.
This is very good practice for applications in the Mac App store. It's a huge security feature. Now, if Apple ever locks down the Mac to allow only applications from the Mac App Store (they won't), I'll give up Mac and go to Linux full-time (I use Macs for neuroimaging research and definitely don't have the applications/tools I use available through the Mac App Store; it would be nice to have a lot of them on a central repository though like Neurodebian {I virtualize that on my Macs}), but in the mean time I'll stick with my Macs. This is a wonderful security feature for applications given stamps of approval from Apple through the Mac App Store. Yes, there might be other security issues introduced through OS X issues but in general this is a positive step forward. Again, I'm not suggesting all applications should be sandboxed, I just think it is good practice for the ones distributed through the Mac App Store.
No. Their target market wants appliance-like reliability.
Other software choices exist outside the RDF and the sooner those who WANT choice are shunted there by Apple and MSFT the better.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
This would be an important security feature if users could force it for any program.
Sandboxing applications is a common security model on Unix systems, so why is this a bad thing on desktop apps as well? The App Store apps already had restrictions on where you could put your executable. This just codifies other accesses into a model where the developer sets up the privileges the app requires instead of leaving it at the free-for-all it is now.
The future of all applications will be individual sandboxes. Why the hell would you have perimeter security (show your credentials to access the enture kingdom) versus a police state (show me your papers) that denies all privileges not specifically granted. I'm not saying I want to physically live in that world, but I definitely want my computers operating in that world
So a free Twitter app isn't allowed to take screenshots while I have my checkbook app open? I'm OK with that. Every one of those restrictions seem perfectly reasonable and good.
Dewey, what part of this looks like authorities should be involved?
I do think some kind of sandboxing would be nice; for example, blocking Skype from automatically installing plugins in every browser under the sun without asking my permission. It's important that sandboxing doesn't prevent programs from being useful.
No, I will not work for your startup
Developing for WP7 requires a mac?
What?
People are developing for WP7?
OK, not the "central authority can veto apps" part.
But the "app package declares what system calls it needs to access; package manager reports it; sandbox enforces it" part.
You can achieve it in a limited way with things like chroot, but having it conveniently bundled is nice.
# apt-get install gnuTunes /usr/share/Music/ ... and so on.
INFO: gnuTunes requires:
- read/write access to ~/.gnuTunes/ for the user
- access to audio output
- read access to the optical drive
- read/write access to ~/Music/ for the user
- read access to
- make HTTP requests to http://gracenote.com/
You can install an application from anywhere. Apple is simply providing application writers a mechanism to help ensure user security (that you can also use in building non app-store apps), and a channel for people to get applications that they know will have less potential impact on the system if there's a security issue. If I get a computer for a grandparent and say "buy applications from here" then they are substantially better off and I can rest easier knowing it's less likely the system is compromised, even if any given application is compromised.
I would say what is restrictive is the notion that users should have to understand computers well enough to secure them. That is the real prison which we have forced millions to endure for years. A computer that people can use to a great desire without worrying about how to "maintain" it is liberation for 99% of computer users on the planet.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Ever heard of Android? Works the same way.
Every time Google adds a sensitive API to Android and documents it, it adds a corresponding permission to the application manifest schema. This means every single documented API in Android is either A. covered by the generic permission for all installed applications or B. covered by one of the permissions that an application can request. This Mac App Store sandbox, on the other hand, appears to add a category C: APIs that no sandboxed application can request, even with good reason. The page behind the second link points out a few noticeable omissions in the available permissions. This points to one of two paths of speculation: either Apple will add permissions covering these holes in a later revision of the policy, or Apple plans to completely remove the functionality corresponding to those holes in future versions of Mac OS X.
Yep.
"OS X is a full fledged UNIX and as such, you'll always be able to do *Nixy things such as wget/curl a file, gunzip, configure and make"
I wouldn't bet on it. Its entirely possible to make the kernel limit what a user can do above and beyond a chroot jail - SELinux does it already. That doesn't make it any less of a version of unix. All you'd see on the command line is the "Operation not permitted" error and that would be that.
As for apple being dead if they messed about with the unix roots of OS/X , very unlikely. 99% of apple users couldn't care less and most of them don't even know their OS is a version of unix.
Would develop* the death of android would not prompt an exodus to apple but to wp7, most people who own an android specifically chose not to go apple cause of apple bs, and while microsoft has their share, it's not nearly as bad.
Then again the death of android is only speculative by people who are not even close to being qualified to make that judgement (slashdotters), so I'll be enjoying my android for a long time to come I'm sure.
- The real news is that the deadline was announced today as March 1 2012, whereas back in the summer at WWDC it was announced as November 1 2011. So they've just delayed this for 4 months--probably to continue refining it.
This means you must ask Apple for read or read/write entitlements for additional folders outside your Application Support folder...
- But you are always allowed access to read/write files that the user selects through the normal open/save dialogs. So this restriction just applies to files you create without the user's specifying the location. Now, this still does potentially create some problems with some kinds of legitimate file access, keeping track of and using previously-saved/read files, and that sort of thing. But it's not nearly as drastic as the summary makes it sound.
This is not to prevent trojans from coming from the App Store, it is to decrease the attack area of apps if exploits are found through them. For example suppose an app registers an URI handle, but does not properly sanitize the data before processing it leading to an arbitrary code exploit. It would still have to bypass the sandbox to further infect the system. Yes, pretty much all malware software is based on trojans. But that doesn't mean that ignoring other risks is a good thing.
The biggest problems with sandboxing is making sure that rules are tight enough but no tighter. Most of the developer complaints I've seen are either the "sandboxing is hard, I don't want to worry about enumerating what my app will do so that everything else can be blocked" or the "sandboxing is fine in principle, but without the ability to mark ( plugins / full filesystem access / ) as allowed my app will ( have reduced functionality / be unable to work )." The later issues are the ones I think that have merit. I can understand Apple being extremely tight with the original permissions because it's easier to loosen up rather than tighten, but it is going to limit what apps from the App Store can do. Hopefully they will be using some of the extra time from moving the sandbox deadline that was originally this month to March, to improve selection of the sandbox criteria to better meet the needs of some of the developers that are unable to work with the options currently provided.
The one thing I like about Apple's sandboxing over some other approaches is that it isn't noisy to the end users. People like most of us on this forum might care, but the average user sees a dialog that such an such app is requesting permissions to do . and there eyes glaze over and they either just press accept to get to the program or start panicking needless and become more susceptible to fake antivirus software claims.
Lots of people who are slashdotters are the ones writing the software to be deployed in future. 2 years ago I had iPhone projects out the wazoo (before that it was Nokia/Qt and blackberry), last year it was blackberry because we're close to RIM and they gave us free stuff, along with iPhone and QT was gone, this year it's android, and next year we're slated for WP7.5 or WP8.
Windows phone development is pretty easy, and I have a suspicion they can angle into the business market from RIM, while still tying into the xbox for gaming related stuff on the phone, that's a fairly big market. The big player in all of this is samsung. Sony is in the Android court, Nokia in MS. RIM is off doing it's own thing in fantasy land, and without steve jobs to sell their bad stuff Apple is going to be in trouble. With Google buying Moto mobile and Nokia and MS drinking the same kool-aid in the same bed, Samsung is the big player in all of this, and as much as they might be in the Android camp now a better corporate connected experience from MS could quickly sway them (or google going crazy with Motorola Mobile somehow).
I think WP7 devices will be as powerful as androids, but, loathe as I am to credit steve ballmer with anything, his 'you need a degree in CS to use an Android' is hyperbole, but not far off. MS could make a much cleaner experience with an equally powerful store and change the game considerably, if they can get Samsung and Nokia to produce decent handsets quickly.
Applications for Windows Phone 7 must be written in a language that compiles to verifiably type-safe IL and must not use System.Reflection.Emit. All the efficient ways I know of making an emulator use either (unsafe) native code or Emit.
I don't really care about this at all; in fact, it's a perfectly reasonable thing to do -- with one caveat. They must at least have an option to run non-Mac store applications on the computer. If we ever get to a point where we can't run arbitrary code on general purpose computers without some sort of special permission from the manufacturers, we're fucked.
--Jeremy
Jesus was a liberal
ok, it really is nonsense-summary week on /.
This is fantastic news for everyone who is worried the slightest bit about security. This has absolutely nothing to do with turning a Mac into an appliance, and nobody from within Apple has ever alleged that non-App-Store installations would be made difficult or impossible.
But what this is is a huge and desperately step needed in putting applications into their own corner. Imagine what would happen if random apps couldn't crap all over your system? The horror! Most of the spy- and malware would go away!
The OS X sandbox is actually a fairly nifty beast, but is has been under-used. This is a great step into pushing it out and making developers accept that just because I want to use their app I don't mean to give them full access to everything on my system - not even everything I can access with my user account.
Assorted stuff I do sometimes: Lemuria.org
You do realize that Gartner is basically a subsidiary marketing division for Microsoft right? And has been for what, 15 years? Their reports ALWAYS favor Microsoft. Shit, they probably said Bob was going to take over the world. You really have to be dense to believe anything they 'report' on.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
That was intended to be a facetious reply to a rhetorical question. Nothing serious.
>Their reports ALWAYS favor Microsoft
Like this one? The first Google hit?
http://www.eweek.com/c/a/Messaging-and-Collaboration/Gmail-Now-Credible-Rival-to-Microsoft-Exchange-Gartner-617996/
Your comments NEVER favor Microsoft though. :) People have to be dense to believe you?
This space for rent.