{"action":"created","issue":{"url":"https://api.github.com/repos/itchio/itch.io/issues/707","repository_url":"https://api.github.com/repos/itchio/itch.io","labels_url":"https://api.github.com/repos/itchio/itch.io/issues/707/labels{/name}","comments_url":"https://api.github.com/repos/itchio/itch.io/issues/707/comments","events_url":"https://api.github.com/repos/itchio/itch.io/issues/707/events","html_url":"https://github.com/itchio/itch.io/issues/707","id":256660296,"number":707,"title":"macOS sandbox preventing games from creating save files.","user":{"login":"AppleFoxUser42","id":664534,"avatar_url":"https://avatars1.githubusercontent.com/u/664534?v=4","gravatar_id":"","url":"https://api.github.com/users/AppleFoxUser42","html_url":"https://github.com/AppleFoxUser42","followers_url":"https://api.github.com/users/AppleFoxUser42/followers","following_url":"https://api.github.com/users/AppleFoxUser42/following{/other_user}","gists_url":"https://api.github.com/users/AppleFoxUser42/gists{/gist_id}","starred_url":"https://api.github.com/users/AppleFoxUser42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AppleFoxUser42/subscriptions","organizations_url":"https://api.github.com/users/AppleFoxUser42/orgs","repos_url":"https://api.github.com/users/AppleFoxUser42/repos","events_url":"https://api.github.com/users/AppleFoxUser42/events{/privacy}","received_events_url":"https://api.github.com/users/AppleFoxUser42/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-09-11T10:51:04Z","updated_at":"2017-09-11T21:59:18Z","closed_at":null,"author_association":"NONE","body":"the itch.io sandbox option does what it's supposed to do. It stops applications from accessing  the system in ways not wanted by the user. Sadly this also sometimes means, the app cannot access the folders with the save-data or even create save-data. \r\n\r\nAnother problem arises through denied read permissions, which sometimes makes it impossible to navigate to folders form within the game where saving would be allowed."},"comment":{"url":"https://api.github.com/repos/itchio/itch.io/issues/comments/328671159","html_url":"https://github.com/itchio/itch.io/issues/707#issuecomment-328671159","issue_url":"https://api.github.com/repos/itchio/itch.io/issues/707","id":328671159,"user":{"login":"fasterthanlime","id":7998310,"avatar_url":"https://avatars0.githubusercontent.com/u/7998310?v=4","gravatar_id":"","url":"https://api.github.com/users/fasterthanlime","html_url":"https://github.com/fasterthanlime","followers_url":"https://api.github.com/users/fasterthanlime/followers","following_url":"https://api.github.com/users/fasterthanlime/following{/other_user}","gists_url":"https://api.github.com/users/fasterthanlime/gists{/gist_id}","starred_url":"https://api.github.com/users/fasterthanlime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasterthanlime/subscriptions","organizations_url":"https://api.github.com/users/fasterthanlime/orgs","repos_url":"https://api.github.com/users/fasterthanlime/repos","events_url":"https://api.github.com/users/fasterthanlime/events{/privacy}","received_events_url":"https://api.github.com/users/fasterthanlime/received_events","type":"User","site_admin":false},"created_at":"2017-09-11T21:59:18Z","updated_at":"2017-09-11T21:59:18Z","author_association":"OWNER","body":"> well you could use access to sh and /usr/bin to start osascript and use that to gain access to the System Event Interface over applescript (osascript) with which you could start another sh without restrictions. That's actually a known exploit: https://www.coresecurity.com/content/apple-osx-sandbox-bypass\r\n> I would think, though that it has been fixed since. Maybe I'll look into it tomorrow.\r\n\r\nAh I see, unfortunately that sounds more like a bug on the Apple sandbox side than ours - as in, I'm sure if the osascript binary (if it's a binary) can open some port and send some data, they could do it without access to the osascript binary, so preventing that will not really close the hole.\r\n\r\n> What would you propose I do about those specific games? Write external sandbox profiles outside of itch? luckily those are free2play titles.\r\n\r\nFor the end-user, the app should (it doesn't yet) allow disabling the sandbox for specific games, so that would solve your issue\r\n\r\nA fix for everyone would be for those games to write to `~/Library/Application Support`"}}
{"actor":{"display_login":"fasterthanlime"}}