macos: Update our macOS entitlements

Our entitlements were last updated when Dangerzone was considering
using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use
Docker Desktop, we can make them stricter.

Fixes #638

CHANGELOG.md

@@ -7,6 +7,10 @@ since 0.4.1, and this project adheres to [Semantic Versioning](https://semver.or
 
 ## Unreleased
 
+### Changed
+
+- Make our macOS entitlements stricter, by enabling App Sandbox ([issue #638](https://github.com/freedomofpress/dangerzone/issues/638))
+
 ## Dangerzone 0.5.0
 
 ### Added

install/macos/entitlements.plist

@@ -2,8 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
     <dict>
-        <!-- <key>com.apple.security.app-sandbox</key>
-        <true/> -->
+        <key>com.apple.security.app-sandbox</key>
+        <true/>
         <key>com.apple.security.inherit</key>
         <true/>
         <key>com.apple.security.files.user-selected.read-write</key>
@@ -12,9 +12,5 @@
         <true/>
         <key>com.apple.security.network.server</key>
         <true/>
-        <key>com.apple.security.hypervisor</key>
-        <true/>
-        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-        <true/>
     </dict>
-</plist>
+</plist>