sandboxd is a helper for the macOS App Sandbox, which limits what sandboxed apps (including every Mac App Store app) can reach, and its man page says it performs services for the Sandbox kernel extension; it's part of macOS. It rarely uses CPU, and a flood of sandbox 'deny' messages in Console points at the app trying to reach things outside its sandbox, not at sandboxd.
Last reviewed · 1 source
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/sandboxd |
|---|---|
| Runs as | root |
| Signed by | Apple (Software Signing), identifier com.apple.sandboxd |
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the network, hardware devices and other processes) based on the entitlements the app declares. The kernel enforces those limits through the Sandbox kernel extension; sandboxd, per its man page, performs services on that extension's behalf, such as logging sandbox violations. Apps sold on the Mac App Store must be sandboxed.
Apps failing to access files or folders they need due to sandbox restrictions
Sandbox violation errors in Console when apps attempt unauthorized operations
Performance overhead from sandbox policy evaluation on file-heavy operations
Apps crashing when denied access to a required resource
If an app can't access files or resources, go to System Settings > Privacy & Security and check the relevant categories (Files & Folders, Full Disk Access, etc.). Grant the app the permissions it needs to function.
Open Console.app and filter for 'sandbox' or 'deny.' These messages show exactly what operation was blocked and which app triggered it, helping you understand what permission the app needs.
Each sandboxed app has a container at ~/Library/Containers/[bundle-id]/. Deleting this folder resets the app's sandboxed data and permissions. The app will recreate it on next launch with fresh defaults. Back up any data in the container first.
If a sandboxed app consistently can't access something it needs, the developer may need to add the correct entitlements to their app. Report the specific sandbox violation message from Console to help them fix the issue.
sandboxd running in the background with minimal resource usage is normal — it only activates when sandbox policy decisions are needed. Be concerned if you see a flood of sandbox denial messages for a specific app, which could indicate the app is trying to access resources beyond its declared capabilities, potentially signaling malicious behavior.
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers ...
tccd manages the macOS TCC (Transparency, Consent, and Control) framework — the privacy permission system that controls ...
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL...
sandboxd is a helper daemon for the macOS App Sandbox: its man page says it performs services on behalf of the Sandbox kernel extension, such as recording violations. The App Sandbox restricts what each sandboxed app can access (files, network, hardware and other processes) to what its entitlements allow, and the kernel enforces it, which limits what a compromised app can reach.
Apps are blocked when they try to access resources not included in their sandbox entitlements. This is usually by design — the app only needs access to specific resources. If an app legitimately needs access, grant it through System Settings > Privacy & Security. If you see unexpected denials, it may indicate the app is trying to do something it shouldn't.
sandboxd is an important security component but is primarily relevant for sandboxed apps (all Mac App Store apps and many others). It significantly limits the damage a compromised app can do by restricting its access to only what it explicitly needs. Disabling it would weaken macOS's security posture.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser