Is The Dry Run Really Dry?

My mac dotfiles installer has a dry run flag.

I’ve added some new features since I originally implemented it, so I wanted to be able to easily/programatically determine that my dry run is actually staying dry (not changing anything).

What I did was make a simple sandbox config (dryrun.sb)

(version 1)

(deny default)

(allow process-exec)
(allow process-fork)
(allow file-read*)

Then I ran my shell script through sandbox-exec like so:

sandbox-exec -f dryrun.sb ./install.sh --dry-run

But that was a bit too strict and it was silently failing.

It turns out some other permissions are necessary to run your typical shell script and Claude was really helpful in sorting that out, since the output was not giving any clues.

Here is the final version of the config:

(version 1)

(deny default)

(allow process-exec)
(allow process-fork)
(allow file-read*)
(allow file-write* (literal "/dev/stdout"))
(allow file-write* (literal "/dev/stderr"))
(allow system-info)
(allow sysctl-read)

Voila, the dryrun runs successfully if my script obeys the sandbox rules, otherwise it errors out if the script attempts to write.

You may need to add further allows depending on what the shell script in question is attempting. You can also make the write protection more nuanced by allowing certain writes:

   (allow file-write* (subpath "/var/tmp"))

There might be a better way to do this, but I thought it was fairly clever.