配置MacOS FreeCAD sandbox

使用如下命令跟踪sandbox的deny信息

sudo /usr/bin/log stream \
    --style compact \
    --level debug \
    --predicate 'eventMessage CONTAINS[c] "Sandbox:" AND eventMessage CONTAINS[c] "deny("'|grep freecad

最终拼接出了如下内容，FreeCAD需要访问当前用户目录下的 如下路径(User以～代替)

; Path only read
~/.CFUserTextEncoding
~/Library/Keyboard Layouts
~/Library/Input Methods

; Path to read and write
./.FreeCAD
~/Library/Application Support/FreeCAD
~/Library/Caches/FreeCAD
~/Library/Preferences/FreeCAD

附freecad.sb seatbelt sandbox 规则文件 (注意替换/Users/vrqq和 FreeCAD.app 路径)
freecad.sb

运行
sandbox-exec -f freecad.sb ./FreeCAD.app/Contents/Resources/bin/freecad