Re: sandbox-darwin.c: sandbox.h is deprecated

On Fri, Aug 14, 2026 at 04:24:22PM +0100, Sevan Janiyan wrote:
> On 09/06/2026 14:48, Marius Schamschula wrote:
[....]
> Manual for sandbox_init(3) marks all the profiles including
> kSBXProfilePureComputation as deprecated, and states "These profiles must
> not be used when building against macOS SDK >= 27.0. Processes opting into
> them will be killed on attempt to do so."
> 
> Builds fine when configured --with-sandbox=no

This at least fixes the build problem by requiring kSBXProfilePureComputation
before enabling that sandbox at build time.  It seems to work on my old
mac mini to enable the sandbox, but I don't have anything new enough to
test the disabled case.  If someone can confirm it works (you'll need
to run "autoreconf" before re-running configure) then I'll apply it.

If anyone (especially Apple!) wants to help us out with whatever the
replacement interface code would be then we would be all ears.

diff --git a/configure.ac b/configure.ac
index cb1711f6b..a0fc91a37 100644
--- a/configure.ac
+++ b/configure.ac
@@ -859,6 +859,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	AC_CHECK_LIB([sandbox], [sandbox_apply], [
 	    SSHDLIBS="$SSHDLIBS -lsandbox"
 	])
+	AC_CHECK_DECLS(kSBXProfilePureComputation, [], [], [#include <sandbox.h>])
 	# proc_pidinfo()-based closefrom() replacement.
 	AC_CHECK_HEADERS([libproc.h])
 	AC_CHECK_FUNCS([proc_pidinfo])
@@ -3904,10 +3905,12 @@ fi
 
 if test "x$sandbox_arg" = "xdarwin" || \
      ( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \
-       test "x$ac_cv_header_sandbox_h" = "xyes") ; then
+       test "x$ac_cv_header_sandbox_h" = "xyes" && \
+       test "x$ac_cv_have_decl_kSBXProfilePureComputation" = "xyes") ; then
 	test "x$ac_cv_func_sandbox_init" != "xyes" -o \
-	     "x$ac_cv_header_sandbox_h" != "xyes" && \
-		AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
+	     "x$ac_cv_header_sandbox_h" != "xyes" -o \
+	     "x$ac_cv_have_decl_kSBXProfilePureComputation" != "xyes" && \
+		AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h, sandbox_init() and kSBXProfilePureComputation])
 	SANDBOX_STYLE="darwin"
 	AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
 elif test "x$sandbox_arg" = "xseccomp_filter" || \

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.