Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is it sandboxed?


Apparently, though it seems to have been granted quite a few exceptions:

  $ codesign -d --entitlements - /Applications/Microsoft\ Word.app/
  Executable=/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
  	<key>com.apple.security.cs.disable-library-validation</key>
  	<true/>
  	<key>com.apple.developer.aps-environment</key>
  	<string>production</string>
  	<key>com.apple.security.assets.pictures.read-only</key>
  	<true/>
  	<key>com.apple.security.temporary-exception.sbpl</key>
  	<array>
  		<string>(allow file-read* file-write*
  
  
  
  
  
       (require-all (vnode-type REGULAR-FILE) (regex #"(^|/)~\$[^/]+$"))
  
  
  
     )</string>
  		<string>(deny file-write*
       (subpath (string-append (param "_HOME") "/Library/Application Scripts"))
       (subpath (string-append (param "_HOME") "/Library/LaunchAgents"))
      )</string>
  	</array>
  	<key>com.apple.security.app-sandbox</key>
  	<true/>
  	<key>keychain-access-groups</key>
  	<array>
  		<string>UBF8T346G9.*</string>
  	</array>
  	<key>com.apple.security.temporary-exception.apple-events</key>
  	<array>
  		<string>com.microsoft.outlook</string>
  		<string>com.microsoft.lync</string>
  		<string>com.microsoft.skypeforbusiness</string>
  		<string>com.filemaker.client.pro12</string>
  		<string>com.thomsonresearchsoft.endnote</string>
  		<string>com.dessci.mathtype</string>
  	</array>
  	<key>com.apple.security.assets.movies.read-only</key>
  	<true/>
  	<key>com.apple.security.automation.apple-events</key>
  	<true/>
  	<key>com.apple.security.temporary-exception.shared-preference.read-write</key>
  	<array>
  		<string>com.microsoft.autoupdate2</string>
  		<string>com.microsoft.office</string>
  		<string>com.microsoft.shared</string>
  	</array>
  	<key>com.apple.security.files.user-selected.read-write</key>
  	<true/>
  	<key>com.apple.security.application-groups</key>
  	<array>
  		<string>UBF8T346G9.Office</string>
  		<string>UBF8T346G9.ms</string>
  		<string>UBF8T346G9.OfficeOsfWebHost</string>
  		<string>UBF8T346G9.OfficeOneDriveSyncIntegration</string>
  	</array>
  	<key>com.apple.security.scripting-targets</key>
  	<dict>
  		<key>com.apple.mail</key>
  		<array>
  			<string>com.apple.mail.compose</string>
  		</array>
  	</dict>
  	<key>com.apple.security.print</key>
  	<true/>
  	<key>com.apple.application-identifier</key>
  	<string>UBF8T346G9.com.microsoft.Word</string>
  	<key>com.apple.security.temporary-exception.files.home-relative-path.read-only</key>
  	<array>
  		<string>/Library/Application Support/Microsoft/</string>
  	</array>
  	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
  	<array>
  		<string>com.microsoft.office.licensingV2.helper.port</string>
  	</array>
  	<key>com.apple.security.temporary-exception.shared-preference.read-only</key>
  	<array>
  		<string>com.ThomsonResearchSoft.EndNote</string>
  	</array>
  	<key>com.apple.security.temporary-exception.files.absolute-path.read-only</key>
  	<array>
  		<string>/Library/Preferences/com.microsoft.office.licensingV2.plist</string>
  		<string>/Library/Application Support/Microsoft/</string>
  	</array>
  	<key>com.apple.security.files.bookmarks.app-scope</key>
  	<true/>
  	<key>com.apple.developer.team-identifier</key>
  	<string>UBF8T346G9</string>
  	<key>com.apple.security.network.client</key>
  	<true/>
  	<key>com.apple.security.personal-information.addressbook</key>
  	<true/>
  	<key>com.apple.security.assets.music.read-only</key>
  	<true/>
  	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
  	<true/>
  </dict>
  </plist>


If you are big you can get exceptions to get onto mac app store . The is not the long waiting fix for Mac App Store that would show signs of development.


My question exactly: did MS change Office to get in the Mac App Store rules or did Apple change the MAS rules to get Office in?


Neither. The existing Office desktop apps are already sandboxed.


Apple has allowed Microsoft Office quite a few exemptions that are not normally handed out.


What did office do before that would have required a non-sandboxed implementation? One pro-sandboxing point for office would be not allowing any sort of auto-updates if the user doesn't want them (and no repeated bugging of users about it).




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: