Re: sandbox-darwin.c: sandbox.h is deprecated

Hello Apple developers,

Damien Miller wrote on Sun, Aug 16, 2026 at 02:09:57PM +1000:

> It would be good to get the sandbox updated to use whatever current
> facilities are offered by MacOS, assuming they exist. Any Apple
> developers want to help?

Please note that for the last decade, i.e. since July 2016, the
mandoc(1) manual page formatting and display program also used
<sandbox.h> and sandbox_init() if available on the platform it was
built on, albeit with two differences to OpenSSH:

 1. It called
      sandbox_init(kSBXProfileNoInternet, SANDBOX_NAMED, NULL)
    i.e. it used a different profile, one that would obviously
    not be appropriate for OpenSSH.

 2. Since the beginning, the automatic configuration test
    checked that the full call
      sandbox_init(kSBXProfileNoInternet, SANDBOX_NAMED, &ep)
    succeeded, i.e. including checking availability of the
    specific profile.

Consequently, even without any code changes, i would not expect
the mandoc build to fail even on the newest macOS (though i admit
i did not test).  I expect Apple-style sandboxing would simply
be disabled for lack of the API.

However, i chose a different action for now.
I dislike using a security feature that is deprecated by the inventor
of that feature.  I dislike even more to have a security feature
targeted at one specific operating system that gets automatically
disabled on that very operating system - that is highly confusing
and may give users of that operating system a false sense of security
if they notice there is specific security code for their system,
but fail to notice it is outdated and automatically disabled.

Consequently, i deleted support outright from mandoc for the
obsolete Apple feature <sandbox.h> / sandbox_init() that macOS
no longer supports.

If Apple provides a replacement feature that free, source-code-only
software can use, i'm potentially willing to put patches to use
that feature into mandoc, but at this time, i'm not aware of any
such feature, so for now, Apple users of mandoc must make do without
sandboxing.

Whoever wants to help with this, please help the OpenSSH team first
because obviously, OpenSSH is *much* more security-critical than
mandoc.  Then again, if whoever helps OpenSSH still has time after
that, help improving mandoc for macOS would also be welcome, in
particular considering that Apple switched their default manual
page formatting software from groff(1) to mandoc(1) in October 2022
(following what FreeBSD did eight years earlier, which seems to me
like a typical delay for merging improvements from FreeBSD to macOS).
So what Apple did was essentially switch their documentattion
formatting tool to a program that supported sandboxing exclusively
for them, then delete the sandboxing API used by that program,
without (unless i missed something, which i would be sorry for)
ever contacting the developer in charge of the program.  To some,
it may feel surprising that a corporation as resourceful as Apple
would behave that way.  To me, it is not actually all that surprising.
I have been in contact with developers from several operating
systems, including some developed by companies of significant size
like SUSE and Fedora, but i don't recall ever managing to get into
contact with anyone at Apple, regarding any topic whatsoever.

Yours,
  Ingo