Skip to content

Tagged: #sandbox

← Back to all articles
What happens when you launch an app on macOS
From double-click to first window: LaunchServices, launchd, posix_spawn, AMFI, dyld, the shared cache, sandbox profile installation, the runloop. Six subsystems in three seconds.
bsdlaunchddyldamfi
macOS Sandbox Profiles (SBPL) Explained
How macOS sandbox profiles work: SBPL syntax with real examples, how libsandbox compiles them, and how the kernel evaluates them on every syscall.
securitysandboxsbplkernel
macOS security architecture: signing, sandbox, SIP, TCC
Six interlocking layers — code signing, AMFI, entitlements, sandbox profiles, SIP, TCC, and the SEP — that together decide what code is allowed to do on a Mac.
securitycode-signingsiptcc