Seatbelt (macOS App Sandbox)
kernel-featuremacOS's built-in process sandbox, driven by SBPL profiles via sandbox-exec / sandbox_init.
Third-party mirror: Apple no longer publishes first-party docs for the SBPL / sandbox-exec mechanism (its current docs cover only the newer entitlements-based App Sandbox). This is the man page still shipped on macOS.
Seatbelt is the macOS App Sandbox: a kernel-enforced process sandbox built on the TrustedBSD MAC framework, configured with SBPL profiles and applied via sandbox-exec or the sandbox_init API. It is the only real process-sandbox mechanism on macOS and is ubiquitous (Chrome uses it). The public API is technically deprecated but still the standard tool. It is the macOS counterpart to Landlock + seccomp + bubblewrap on Linux, and the mechanism Codex, Claude Code, Zed, and nono all use on the Mac.
Strengths
- Built into macOS, no extra runtime, kernel-enforced via TrustedBSD MAC
- Fine-grained SBPL profiles over files, network, and Mach services
- The de-facto standard on macOS (Chrome and the agent sandboxes all use it)
Limitations
- macOS only
- The sandbox-exec/sandbox_init API is officially deprecated, though ubiquitous
- Shared kernel, a kernel exploit is below it