We Need To Talk About MACL

This blog post reverse-engineers macOS User-Intent and the com.apple.macl attribute, explains how sandbox extension tokens are issued and consumed by Sandbox.kext, and discloses CVE-2020-9968 — a vulnerability allowing a TCC privacy bypass by applying MACL entries (demonstrated via a chroot-based proof-of-concept). The author details the internals, PoC steps, impact, and confirms Apple patched the issue in macOS 10.15.6 (and equivalent iOS/watchOS/tvOS releases).