Comment by mike_hearn

I need to write a proper introduction to macOS security because this thread has lots of incorrect assumptions about it!

macOS doesn't determine once whether Word can read all your documents. That's the sort of policy that applies to non-native Mac apps. Word is a native Mac app built according to Apple's design specs. Like the rest of the Office suite it opts into the stronger "app sandbox" feature macOS offers. That means:

1. It can only read files that the user granted specific access to by opening them with the system file picker. This grant is persistent across app restarts, upgrades and file moves, but is fine grained.

2. Its own files are protected against tampering from other apps. That means not just the app's binaries (which are protected in all cases regardless of app opt in), but also its own data files stored in $HOME too, like download caches. Obviously its address space is fully protected from debugging APIs too.

So if Word is compromised by a macro virus or buffer overflow, or whatever, that code is very constrained. It can't steal your SSH keys. It can't tamper with your ~/.bashrc. It can't tamper with your operating system, or escalate to root, or phish any credentials from you. Despite that, Word has all the functionality users expect.

Additionally, if you download and run malware, that malware can't edit the configuration of Word to inject macros, and if you store files in Word's protected area they can't even read those files.

MacOS only falls back to coarse grained permissions for looking at certain sub-folders of $HOME when apps bypass the native Cocoa APIs, e.g. by using open() and readdir() directly. This usually means some dev tool or script that was written with Linux in mind.

All this is possible because the kernel has very sophisticated support for app identity and security. It's exactly what you're asking for, and what Linux has failed to provide. You can open a file in Word thus granting Word access to it without even realizing you're doing it, then upgrade or downgrade Word without it losing access, move those files around, move Word around, download a beta version from some internal MS server and have two versions installed at once, etc. It's all possible because of sophisticated kernel level support working in close tandem with a lot of userspace infrastructure which is missing on Linux.

Re: entitlements. Apple's system allows entitlements to be self-declared, or granted by Apple, or both, or granted by non-Apple authorities if the OS is so configured (this latter fact is documented but obscure). MDM, app stores and anti-malware systems exploit entitlements aggressively to understand what apps can do. Their system allows a pretty complex ecosystem to develop where users can delegate trust as much or as little as they like.