Narrow macOS sandbox entitlement to /dev/cu. and /dev/tty. only

The /dev/ prefix granted read/write to all device nodes. The app only
needs access to serial port devices (/dev/cu.* and /dev/tty.*) for USB
LoRa communication.
This commit is contained in:
zjs81 2026-03-07 13:10:42 -07:00
parent e4285774a0
commit 06fa176367
2 changed files with 6 additions and 2 deletions

View file

@ -14,9 +14,11 @@
<true/>
<key>com.apple.security.device.usb</key>
<true/>
<!-- USB serial ports (/dev/cu.* and /dev/tty.*) for LoRa device communication -->
<key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>
<array>
<string>/dev/</string>
<string>/dev/cu.</string>
<string>/dev/tty.</string>
</array>
<key>com.apple.security.device.camera</key>
<true/>

View file

@ -10,9 +10,11 @@
<true/>
<key>com.apple.security.device.usb</key>
<true/>
<!-- USB serial ports (/dev/cu.* and /dev/tty.*) for LoRa device communication -->
<key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>
<array>
<string>/dev/</string>
<string>/dev/cu.</string>
<string>/dev/tty.</string>
</array>
<key>com.apple.security.device.camera</key>
<true/>