On Mac OS X, is it possible to limit an application's accessible hosts by using sandbox-exec?

I can easily do it via a firewall app, but I would prefer to do it via the native sandbox mechanism in certain cases.

So far I've tried by using something like this in the sandbox profile:

(allow default)
(deny network-inbound)
(deny network-outbound)
(allow network-outbound (remote ip ""))

but I get errors when I try to run sandbox-exec:

<snip>: host must be * or localhost in network address

There is no official documentation for the native OS X sandbox as far as I know, and the examples included in /usr/share/sandbox and /System/Library/Sandbox/Profiles/ don't have anything similar to what I'm trying to do.

1 Answer 1


The man page for sandbox-exec says that it is deprecated. Other mentions I've found online indicate that while Apple is unlikely to remove it, it's intended as an internal implementation detail of MacOS: subject to arbitrary change and not well-documented. The most extensive documentation I can find for sandbox-exec is here, which is reverse-engineered only. Page 21 covers this topic, though is not good news:

[network*] Controls all available network operations described below. It has no support for IP filtering, it must be localhost or * (check network filter for more information).

The closest I've been able to find is proxying particular domains to local ports, then allowing traffic to that port. (In my case, this involves starting a devpi server, then telling pip to use that local port.) You could try other tools like nginx or mitmproxy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .