App Sandbox (iOS)
Definition
The iOS isolation mechanism combining UNIX file permissions, signed entitlements, and TrustedBSD mandatory access control. Each app is confined to a container directory under /var/mobile/Containers. Access to resources outside the container requires an explicit entitlement granted by Apple at signing time.
- Platform
- iOS
- Mechanisms
- UNIX permissions, signed entitlements, TrustedBSD MAC
- Container base
- /var/mobile/Containers
- Cross-app access
- Requires an explicit entitlement granted by Apple at signing
Common questions
How does TrustedBSD mandatory access control add protection beyond ordinary UNIX file permissions?+
UNIX permissions alone would let a process with the right user ID access many files, but TrustedBSD enforces additional kernel-level policy checks tied to the app's code-signed identity, blocking access even when standard file permissions would otherwise allow it.
Why does Apple's entitlement signing matter to a forensic examiner analysing an app's capabilities?+
Because cross-container access and many sensitive APIs require an entitlement embedded in the app's signature at build time, inspecting those entitlements shows what data and system resources the app was actually authorised to reach, independent of what the app's own code claims to do.
Related terms
- APFS (Apple File System)
- The default file system on iOS devices since iOS 10.3. Features include 64-bit inode numbers, copy-on-write metadata, file-level encryption using per-file keys,...
- Data Protection Classes (iOS)
- iOS encrypts each file under one of four protection classes that control when the file's encryption key is available: Complete (key available...
- Ext4
- The fourth extended file system, the default Linux file system used for the userdata partition on most Android devices before widespread F2FS...
- F2FS (Flash-Friendly File System)
- A log-structured file system designed for NAND flash, used on the userdata partition of many modern Android devices including Samsung Galaxy and...
- UID-Based Sandbox (Android)
- Android's application isolation model in which each installed app receives a unique Linux user ID at install time. The app's private data...