macOS: Improving security and privacy using Mac OS sandbox and Tor browser bundle

In this article we give a look at a practical case of using BSD sandbox by sandboxing Tor WEB Browser Bundle on Mac OS X to reduce risks of exploits from malicious websites while preserving full anonymity using Tor network and Tor browser.

First thing first, if you don’t have Tor WEB Browser Bundle for Mac OS X, download it from here. Install it following the instructions on Tor website and remember to install Tor Browser in your /Applications directory on your Mac.Once you’ve done installing Tor browser let’s move to the next step which is sandbox it!

Has we have seen already in my previous article about sandboxing on Mac OS X, let’s write our sandbox configuration file for Tor browser. Here is my script (you can improve it yourself if you want, I encourage you to hack it!):

;; Tor WEB Browser Bundle sandbox
;; by Paolo Fabio Zaino
;; License GPL v2
;; Get this file and hack it to perfection 😉
(version 1)
(debug deny)

;; allow processes to traverse symlinks
(allow file-read-metadata)

(allow file-read-data file-read-metadata
  (regex
    ; Allow reading system dylibs and frameworks
    #"^/usr/lib/.*\.dylib$"
    #"^/usr/lib/info/.*\.so$"
    #"^/System/"
    #"^/private/var/db/dyld/"
    #"^(/private)?/etc/hosts\.(allow|deny)$"
  ))

(allow file-read-data file-write-data
  (regex
    ; Allow files accessed by system dylibs and frameworks
    #"^/dev/null$"
    #"^(/private)?/var/run/syslog$"
    #"^/dev/u?random$"
    #"^/dev/autofs_nowait$"
    #"^/dev/dtracehelper$"
    #"/\.CFUserTextEncoding$"
    #"^(/private)?/etc/localtime$"
    #"^/usr/share/nls/"
    #"^/usr/share/zoneinfo/"
  ))

(allow file-ioctl
  (regex
    ; Allow access to dtracehelper by dyld
    #"^/dev/dtracehelper$"))

(allow mach-lookup
  (global-name "com.apple.bsd.dirhelper")
  (global-name "com.apple.system.DirectoryService.libinfo_v1")
  (global-name "com.apple.system.DirectoryService.membership_v1")
  (global-name "com.apple.system.logger")
  (global-name "com.apple.system.notification_center"))

(allow ipc-posix-shm) ; Libnotify

;; (allow sysctl-read)

(allow signal (target self))
 
(deny default)

(allow file-write* file-read-data file-read-metadata
  (regex "^/Users/<your-username>/Downloads")
  (regex "^/Users/<your-username>/Library/Application Support/Mozilla")
  (regex "^/Users/<your-username>/Library/Application Support/Firefox")
  (regex "^/Users/<your-username>/Library/Preferences")
  (regex "^/Users/<your-username>/Library/PreferencePanes")
  (regex "^/Users/<your-username>/Library/Caches/Firefox")
  (regex "^/Users/<your-username>/Library/Caches/TemporaryItems")
  (regex "^/Users/<your-username>/Library/Application Support/TorBrowser-Data/")
  (regex "^/Library/Application Support/CrashReporter")
  (regex "^/Applications/TorBrowser.app")
  (regex "^(/private)?/tmp/"))

(allow file-read-data file-read-metadata
  (regex "^/dev/autofs.*")
  (regex "^/Library/Preferences")
  (regex "^/Library/Fonts")
  (regex "^/Library/Internet Plug-Ins")
  (regex "^/Library/PreferencePanes")
  (regex "^/usr/share/icu")
  (regex "^/usr/share/locale")
  (regex "^/System/Library")
  (regex "^/Applications/TorBrowser.app")
  (regex "^/usr/lib")
  (regex "^/usr/local/lib")
  (regex "^/var")
  (regex "^/private/var/tmp/")
  (regex "^/private/tmp/")
  (regex "^/Users/<your-username>")
  (regex #"Frameworks/SDL.framework"))
 
(allow mach* sysctl-read)

(deny file-write-data
   (regex #"^(/private)?/etc/localtime$"
     #"^/usr/share/nls/"
	 #"^/usr/share/zoneinfo/"))

;; (allow process-exec* 
;;  (regex "^/Applications/TorBrowser.app"))

(allow process-exec*)
  
(allow network*)
(allow iokit-open)
(allow ipc-posix-shm)
(allow process-fork)

So, copy and paste the script above in your terminal window after you started creating your own configuration file by executing:

$ vi torbrowser.sb

Please note: once you past the source code from here remember to change each instance of <your-username> with just your user name on your Mac (LITERALLY JUST YOUR USERNAME).

Save your file ( Press ESC and then type :wq ) and you are ready to go to the next step which is execute your tor bundle browser using the following instruction (on your terminal window):

$ sandbox-exec -f torbrowser.sb /Applications/TorBrowser.app/Contents/MacOS/firefox

If you have followed all the instructions correctly and, no mistakes happened during previous steps, you’ll see classic Tor Browser window appearing on the screen. You can use it as usual, the only difference is that the Tor browser now is being executed in a sandbox instead on your full account. This protect your Mac more from possible exploits that you may encounter while browsing the web.

Please Note: To get the latest version of the script please check it’s new github repository here.

Happy SAFE and ANONYMOUS browsing everyone! 😉

Please Note:

1. Although Mac has a fame of being a quite secure OS, I always recommend a good antivirus!
2. DO NOT FORGET that MacOS is a proprietary Operating System, and even if Apple seems to be concerned about their customer privacy they still manage to state how many pictures have been taken in a year using their technology! (How do they know that if their products are built with the privacy of their customers in mind?) So, for better anonymous browsing, I always recommend to use Linux (either Tails OS which is an already built and setup distro for anonymous browsing or use Debian and/or fully open source based Linux distro for TOR browsing).
3. Also please don’t forget that proper anonymous browsing is quite hard to achieve, so DO NOT base your solution only on articles like this one or on low cost security courses on sites like Udemy/Lynda/Coursera etc. (I do think these resources are a good starting point to begin learning about cyber security.) There are continuous attempts by companies, Gov’t and cyber criminals to steal data, so they may use your MAC address, zero-days/exploits for that particular version of your browser, scripts and other techniques to still manage to break your anonymity!

Thanks for reading and, if you enjoyed this post, please support my blog by visiting my on-line hacking and engineering merchandise shop on redbubble.com by clicking here, thank you! 🙂