Block sandbox account from mounting disks

[webcoyote]

Prevent sandbox account from mounting disks

[MikeMcQuaid]

@webcoyote Just a thought: will this prevent the Xcode tools from installing Metal? I know it needs to do a disk mount for this and seems to be a per-user operation.

[webcoyote]

@webcoyote Just a thought: will this prevent the Xcode tools from installing Metal? I know it needs to do a disk mount for this and seems to be a per-user operation.

Good call-out! I checked and it works:

sandvault-pat in sandvault🔒 on  disable-mount
❯ xcodebuild -showComponent MetalToolchain
Build Version: 17F109
Status: uninstalled

sandvault-pat in sandvault🔒 on  disable-mount
❯ xcodebuild -downloadComponent MetalToolchain
Beginning asset download...
Downloaded asset to: /System/Library/AssetsV2/com_apple_MobileAsset_MetalToolchain/5f4a441a6d0a11f2e9b28c67384263afe92320f7.asset/AssetData/Restore/022-21788-058.dmg
Done downloading: Metal Toolchain 17F109.

sandvault-pat in sandvault🔒 on  disable-mount took 18s
❯ xcodebuild -showComponent MetalToolchain   # expect: installed
Asset Path: /System/Library/AssetsV2/com_apple_MobileAsset_MetalToolchain/5f4a441a6d0a11f2e9b28c67384263afe92320f7.asset/AssetData
Build Version: 17F109
Status: installed
Toolchain Identifier: com.apple.dt.toolchain.Metal.32023.883
Toolchain Search Path: /private/var/run/com.apple.security.cryptexd/mnt/com.apple.MobileAsset.MetalToolchain-v17.6.109.0.NK2RrA

sandvault-pat in sandvault🔒 on  disable-mount
❮ cat > /tmp/t.metal <<'EOF'
  #include <metal_stdlib>
  kernel void k() {}
EOF

sandvault-pat in sandvault🔒 on  disable-mount
❯ xcrun metal -c /tmp/t.metal -o /tmp/t.air

(no errors)

[MikeMcQuaid]

Thanks for checking 🙇‍♂️