Sandbox path to Rack passed in to sandbox-exec

Makefile

@@ -58,7 +58,7 @@ endif
 
 sandbox-run: $(TARGET)
 ifeq ($(ARCH), mac)
-	sandbox-exec -f ./Rack.sb `which sh` -c 'DYLD_FALLBACK_LIBRARY_PATH=dep/lib ./$<'                                                                      2 ↵  ✹ ✭sandbox ‹2.4.2›
+	sandbox-exec -D RACK_HOME=$(PWD) -f ./Rack.sb `which sh` -c 'DYLD_FALLBACK_LIBRARY_PATH=dep/lib ./$<'                                                                      2 ↵  ✹ ✭sandbox ‹2.4.2›
 endif
 
 debug: $(TARGET)

Rack.sb

@@ -2,6 +2,8 @@
 (version 1)
 (debug allow)
 
+(define rack-home "RACK_HOME")
+
 ; This is needed for IPC on OSX >= 10.6
 (allow ipc-posix-shm)
 
@@ -27,6 +29,8 @@
 
 (allow system-socket)
 
+(allow file-read* file-write* (subpath (param rack-home)))
+
 ; Allow file reading
 (allow file-read*
     (regex