n8henrie

macOS Seatbelt/Sandbox Trace Script

macOS sandbox profiles used to be able to include a trace command that would write all the denied operations to a sandbox profile, allowing a profile to be iterativley built up. Apple removed that functionality for reasons explained below.

trace.sh examines the kernel log for the denied operations and creates the relevant allow rules in a sandbox profile, just like the sandbox profile trace command used to.

shrink.sh tries to reduce a sandbox profile to the minimum lines necessary.

It's very rough and ready at the moment (check the sed regex'es in the script to see what I mean) and needs more testing with a wider set of use cases.

n8henrie

/*.json

n8henrie

#!/usr/bin/osascript -l JavaScript
'use strict'

ObjC.import("Foundation")
const environment = $.NSProcessInfo.processInfo.environment.js

const DEST = Path(environment.HOME.js + "/Music")

function run(_) {
  let music = Application("Music")

n8henrie

#!/usr/bin/osascript -l JavaScript

// 1. Open Keychain Access.app
// 2. Filter by `SSH:`
// 3. Set pw and outfile in this script
// 4. Run
// 5. Transfer the file to the new device
// 5. Use the sloppy script below to then read that file and add to Keychain Access on the new device

/*

n8henrie

#!/usr/bin/env python3
"""
Quick hack to fix links to local files in Markdown notes exported from Joplin 3.1.24.

Run at your own risk, ideally on a duplicate copy of your exported notes, as
this makes destructive changes that would be difficult to undo. This may break
your notes.

Further, special cases like parentheses in filenames are handled differently by
different markdown renderers. You may have to alter the script depending on what

n8henrie

#!/usr/bin/osascript -l JavaScript

function click_ok() {
    const sys = Application('System Events')
    const finder = sys.processes["Finder"]

    try {
        let sheets = finder.windows.whose({name: "NatePhone"}).sheets().flat()
        let message = "cannot be played on this iPhone."
        let error_sheet = sheets.filter(sheet => {

n8henrie

{
  description = "Example use of nixpkgs#darwin-builder";

  # First, read through https://github.com/NixOS/nixpkgs/blob/master/doc/builders/special/darwin-builder.section.md#sec-darwin-builder-example-flake
  # and add yourself to `extra-trusted-users`, verify with `nix show-config | grep -i trusted-users`
  #
  # Copy this flake somewhere and run:
  #
  # ```console
  # $ nix build --builders '' .#packages.aarch64-darwin.default

n8henrie

#!/bin/bash

set -Eeuf -o pipefail

readonly SSH_PORT=1234
readonly USERNAME=me
readonly SSH_KEY=/home/"${USERNAME}"/.ssh/my_key_id_rsa
readonly DEST=my_machine_name

main() {

n8henrie

#!/usr/bin/osascript -l JavaScript

'use strict'

const Safari = Application("Safari")
const Chrome = Application("Google Chrome")
const Brave = Application("Brave Browser")
const SystemEvents = Application("System Events")
const Firefox = Application("firefox")
const DefaultBrowser = Firefox

n8henrie

#!/usr/bin/env python3
"""
search_bad_logins.py :: Compares a LastPass export to your Bitwarden vault.

Python >=3.10, no third party Python libraries / dependencies.

Outputs BW logins that may have been compromised in the recent LastPass hack
based on matching domain and password.

It would probably make sense to cast an even wider net by using something like