do not step out
12/Jul/2005 | 15:47

Hello, World.

There's no official page for it yet, but Sandbox is at the above location.

S-so, what is Sandbox?

From the documentation:

For years, standard POSIX permissions did a good job of defining access to our files and folders. But as our needs have become more complex, operating systems have begun implementing access control lists to help handle things. When Apple shipped Mac OS X 10.4, they brought their ACL implementation to the table, along with a GUI to deal with the mess.

That is, if you're running Mac OS X Server, which comes with Workgroup Manager. Otherwise, it's /bin/sh for you, buddy boy.

Enter Sandbox, stage left.

That's right, Tiger Client now has a GUI-based access control list editor.

Please note: Sandbox requires Mac OS X 10.4 or later, as ACL functionality does not exist in prior versions. The disk image won't even mount on pre-10.4 systems.

If there's something it's missing (and isn't mentioned in the documentation), drop me a line and I'll see what I can do!


What's up, long time Apple Systems Engineer, worked at Apple on FCP QA.

Can the ACL's be likened to more flexibility for what users in the Windows world seem to have, like Power User, etc.

In OS X, you are either Admin or not, in Windows you have levels, like Power User, etc. It also seems to me that even in Tiger the GUI (Accounts Pane) is very limited in assigining rights, etc. Perhaps Sandbox addreses this, thanks.

posted by John Klimeck on July 14, 2005 at 17:31

These ACLs are file system ACLs. What you are looking for is finer granularity in user account capabilities, which this does not solve. You can change some of this behavior in /etc/authorizaton, but its not really what you are looking for. Manage client settings can attach limitations to user accounts as well, but they basically for non admin users.

posted by AMSR on July 14, 2005 at 23:40

When I download the Sandbox disk image, the license agreement dialog is displayed, but then I get an error saying that it's a corrupt image...

posted by tim king on July 15, 2005 at 00:22


Sandbox requires 10.4 because ACLs don't exist in prior versions of Mac OS X. To help ensure people wouldn't try using Sandbox on Panther or Jaguar, I created the disk image so it wouldn't open under pre-10.4 systems. There's a lot of error handling in Sandbox, but since "you don't know what you don't know", I covered that base with a disk image only 10.4 users could open.

Sorry, man.

posted by mikey-san on July 15, 2005 at 03:06

Thank you! After seeing the Workgroup Manager in use on a box running OS X 10.4 Server I was quite perplexed to find out I had nothing similiar on my personal machines so finding this app has certainly brightened my day.

posted by Christopher Black on July 16, 2005 at 06:18

In response to John Klimeck's comment... You should read the following article:


Windows (apparently) makes new users 'Power Users' by default. That sounds careless to me. (It used to be they would be admin by default!).

posted by Chris Murphy on November 16, 2005 at 19:04