How to Run a Shell Script with Mac App Sandbox Enabled

Is it possible to have an app, that runs within the sandbox, execute a shell script? The script makes use of two basic commands:

defaults write
killall

I know that there are some exceptions to the sandbox, that can be added via the entitlements file, but not sure wheter it would be possible to have the user confirm the execution of the small script and then run it?

Please give me a practical hint... When I run my app with sandbox off, everything works fine. With sandbox on both commands are not working and this is shown in the console:

killall: warning: kill -TERM 12322: Operation not permitted




Best Answer:

Why would you want to sandbox such a powerful App it in the first place? Do you want to modify defaults and killall for specific other apps (somehow possible) or for "all that exist on the machine"?

If for specific other apps, why not do it without shell? For defaults write use com.apple.security.temporary-exception.shared-preference.read-write and add the domains you'd like to modify (eg. com.apple.DigitalColorMeter) and use CFPreferencesSetValue()

For killall use com.apple.security.temporary-exception.apple-events and run an Applescript / send AppleEvents to terminate specific processes.