/tags/sandboxd/Recent content in sandboxd on Wojciech RegułaHugo -- gohugo.ioen© Wojciech RegułaThu, 16 Jul 2026 10:00:00 +0000/post/golden-gate-appdata-protection/Thu, 16 Jul 2026 10:00:00 +0000/post/golden-gate-appdata-protection/Summary Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions can’t modify your privacy settings) macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ ~/Library/Containers/<bundle-id>/Data folders to a hand-picked set of non-sandboxed apps’ ~/Library/Application Support/<name> folders too.