Except that app sandboxing excludes a lot of otherwise useful apps.

I don't understand why developers don't just follow Apple's own Xcode example: ship a sandboxed app that, on first startup, offers to run the (elevated) installer for an accompanying OS-integration package. Or does Apple not let anyone but themselves do that?

On the bright side, at least none of Apple's pro apps on the App Store have been excluded due to breaking sandbox restrictions.

Because app developers can request specific sandbox exemptions (so-called "temporary exceptions") when they submit to the app store.

You can view these exceptions by dumping the Container.plist inside a sandboxed app's container, e.g. for Calendar:

  /usr/libexec/PlistBuddy -c "print SandboxProfileDataValidationInfo" $HOME/Library/Containers/com.apple.iCal/Container.plist

Look at the keys beginning with `com.apple.security.temporary-exception`.

(Also note that some Apple apps don't have containers, like iTunes.)

Whoa, thank you so much for bringing PlistBuddy to my attention. I feel as much joy as when I learned about `/usr/libexec/java_home`. Maybe I should just start poking around in /usr/libexec and see what other awesome toys are hiding in there.

Oh please. Where did you take your 1% from?

If your application is not a game, or it does not fit the model of "here be a document, type on it", chances are the sandbox won't allow it. Actually, even if you do follow that model: see BBEdit and Coda.

What about Postbox? iStatsMenu? Heck, even Alfred. Or Parallels, Microsoft Office, the Adobe suite? These cannot be sandboxed.

Frankly, I could come up with more applications if I did some research, but why bother. Nearly everything that's interesting that's not a game will be crippled or just unavailable. And, for games, Steam is better in every way.

EDIT: By "cannot be sandboxed", I mean that they cannot be sandboxed under Apple's current draconian sandboxing rules.

WJoy is my go-to example of an app broken by SIP: it's effectively a third-party driver to change the properties of the Bluetooth stack (and do some extra higher-protocol-layer autonegotiation magic) so that Nintendo Bluetooth devices will connect to OSX. Absolutely needs a Kext to do what it does.

I really don't know why a custom kext is needed. I had great success without any of that. http://blog.mcohen.me/other-stuff/miitransfer/ I also made it so that when I pressed a wiimote button it would simulate pressing a kVK_ code. Maybe it's so that it gets recongnized as a gamepad directly? I remember that being kind of odd.