App Sandbox

An app sandbox is an operating-system mechanism that runs an application in a restricted environment, allowing it to touch only the files, hardware and system services it has been explicitly permitted to use. If the app is compromised, the attacker is confined to those limits.

Why it matters

Software has bugs, and browsers or document readers handle untrusted content all day. Sandboxing means a bug in a PDF viewer should not give an attacker your whole home folder. Mobile systems sandbox every app by default, which is why an Android or iOS app must ask permission for the camera, contacts or location.

Example

A sandboxed macOS app declares entitlements such as "read files the user selects" and "outgoing network connections". Anything not listed is denied by the kernel. Web browsers go further and run each tab's renderer in a low-privilege process that cannot write to the disk directly.

Common mistakes

• Assuming a sandbox is a perfect barrier. Sandbox escape vulnerabilities exist, though they are rarer and harder to exploit.
• Granting broad permissions "just to make it work", which defeats the purpose.
• Confusing an app sandbox with a virtual machine; a sandbox shares the host kernel.

Related

• Least privilege
• Virtual machine
• Process
• Malware

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.