zoom sandbox-exec for macOS

readme.md

1. Download Zoom.pkg from https://zoom.us/download
2. Extract it using https://www.timdoug.com/unpkg/
3. Now you have Zoom/zoom.us.app
4. Launch Zoom by zoom.sh Zoom/zoom.us.app/Contents/MacOS/zoom.us

caveats:

• Zoom will fail to start meeting for the first time. Just launch again.
• Zoom will tell that crash happened, but you should ignore it.

zoom.sh

#!/bin/sh

# Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.
# DISCLAIMER: THE WORKS ARE WITHOUT WARRANTY.

sandbox-exec -p "
(version 1)
(allow default)
(deny file-write*)
(allow file-write*
    (subpath \"${HOME}/Library/Application Support/zoom.us\")
    (subpath \"${HOME}/Library/Logs/zoom.us\")
    (subpath \"${HOME}/Library/WebKit/us.zoom.xos\")
    (subpath \"${HOME}/Library/Caches/us.zoom.xos\")
    (subpath \"${HOME}/Library/Saved Application State/us.zoom.xos.savedState\")
    (subpath \"/private/var/tmp\")
    (subpath \"/private/tmp\")
    (subpath \"/tmp\")
    (subpath \"/private/var/folders\")
    (subpath \"/var/folders\")
)
(deny file* (regex #\"/id_rsa$\"))
(deny file* (regex #\"/id_dsa$\"))
(deny file* (regex #\"/id_ecdsa$\"))
(deny file* (regex #\"/id_ed25519$\"))
(deny file* (regex #\"\\.pem$\"))
" "$@"

If you get an error dialog about the login keychain being missing, you can add the s-expression:

(literal \"$HOME/Library/Keychains/login.keychain-db\")

to the list in the

(allow file-read-data
)

block. the keychain APIs mediate access to the actual sensitive data in the keychain, so my tinfoil hat says this is a reasonable thing to do. Your hat may disagree.

What is the primary use of this script?

primary use

You know Zoom has been developed in China.