title: On MacOS, how to sandbox a daemon process?
body: <p>I'm looking for a way to "sandbox" a "daemon" process on MacOS.</p>
  
  <p>On Linux we have various kernel mechanism to restrict what some process can do (Linux namespaces, seccomp. Capabilities in a way, too). On OpenBSD we have chroot and pledge. On FreeBSD we have jails.</p>
  
  <p>I'm aware of the App Sandboxing mechanism that is available on recent version of MacOSX. But as far as I understand, it is supposed to contain a classical GUI App that a user could launch from /Applications.</p>
  
  <p>Here what I have is just a system daemon (= process) that I'd like to sandbox. For example, that daemon would not need to write to the filesystem, or it would not need to use the network, etc. So I'd like the MacOS system to enforce that by prohibiting access to some ressources.</p>
  
  <p>launchd does not help either. With launchd I can 'daemonize' properly my process, reserve some socket ports, but I did not see any way to "encage" the process.</p>
  
  <p><code>sandbox_init</code> looks more interesting, but it is "DEPRECATED".</p>
  
  <p>That just leaves <code>chroot</code> on MacOS. Of course chroot only prevents <em>some</em> filesystem usage.</p>
  
  <p>Is there another available sandboxing mechanism ?</p>