D9010 VmAppPromises and limits
Security
A security claim is only worth something if it comes with its limits. Here are both.
What the platform promises
When you run an app in the launcher:
Only the files you gave it
The app's engine runs in its own VM. Folders you didn't grant do not exist inside it. Your choice of read, read and write, or write-only is enforced by the hypervisor, outside the app's reach.
No internet unless you name the sites
The VM has no network connection at all. The only way out is a proxy run by the launcher, which lets through only the hosts you allowed for that app. It never reaches your own network.
No app code runs on your Mac as you
The app's window runs in a locked-down browser engine with no file access and no internet. The only code on your Mac with your rights is the launcher itself.
What you installed is what you reviewed
Every file in a package is fingerprinted, and checked at install and again when it is shown. An update that asks for more (a new website, a new port) stops and asks you again.
A clean start every time
The system, the runtime and the app's code are read-only. Temporary files vanish when the app stops. A VM cannot outlive the launcher.
You can see and you can revoke
The Inspector shows every message and every connection. Taking back a permission closes the connections it was using at once.
What it does not protect you from
Stated plainly. The same limits are listed in the full security model.
- Misuse of what you granted. An app with read-and-write access to a folder can change or delete files in it. Prefer read-only and write-only.
- The folder-plus-website pair. An app that can read a folder and reach a website can send what it reads there. The launcher warns you in words when you grant both; it cannot stop you. Grant the pair only to apps you trust.
- What is inside the encrypted connection. The launcher shows which host an app talks to and how much data, not what the data is.
- Browser-engine attacks. Each app's window uses the same engine as Chrome. A serious flaw in it, combined with a sandbox escape, would be as dangerous as in a browser tab. Keep the launcher updated.
- Escaping the VM. Rare and valuable, but not impossible. This is the main remaining risk on the engine side.
- Allowed hardware. An app you let use the microphone can record. An app you let use the GPU can use as much of it as macOS gives. The GPU path is experimental and off by default.
- Not built yet. Publisher signatures (so you can verify who made a package), UDP and inbound network connections, the camera, and per-app resource accounting.
Who the platform assumes might be an attacker
| Who | Wants to… | What stands in the way |
|---|---|---|
| A malicious app engine | Read or encrypt your files | The VM boundary. Only granted folders exist. |
| A malicious app engine | Send your data out | No network device. Only hosts you named. Every connection logged. |
| A malicious app engine | Reach your router or other computers | Rules name hosts, never addresses. The launcher looks the name up itself and refuses any private or local answer. |
| A malicious app engine | Attack other apps | One VM per app. Separate data folders. |
| A malicious app window | Touch files, network or devices | Browser sandbox, no Node, strict content policy, blocked popups. |
| A malicious app window | Fake a permission prompt | Real decisions are native dialogs that name the app. The app cannot draw them. |
| Someone who tampers with a package | Swap code after you reviewed it | Per-file fingerprints checked at install and at use. |
How you can check this yourself
- It is open source. The code, including the launcher and the VM layer, is on GitHub under the MIT licence.
- Builds are reproducible. The base system, kernel, runtimes and app packages rebuild to identical bytes, so anyone can rebuild and compare.
- Releases are signed and notarized by Apple, with checksums published next to the download.
- The rules are numbered. Governance lists them; every change is reviewed against them, and protected parts need the maintainer's sign-off.
- The full security model is in the documentation.
Found a problem? Please report it privately. The process is in the security policy. This is a first public build, so careful eyes are welcome.