Block an application's read/write access to a specific file in OS X? The premise is this:

I have an app which has been set in its code to only run on OS X versions 10.4 to 10.9.2. (When I try to install it, it gives a message "This version of ____ is for Mac OS X 10.4 to 10.9.2."). I have updated to 10.9.3, and the developer just needs to update the app to fix this restriction in his tool.

I'm actually in contact with the developer, who says he is 'too busy' to work on the app or issue an update right now.

I worked out that the app is just reading /System/Library/CoreServices/SystemVersion.plist to determine OS version, and I managed to bypass its installer restriction by temporarily editing the file using this guide. But after reverting the plist values to 10.9.3 and restarting the system to start (hopefully) using the app, I saw that it even checks SystemVersion.plist to even run as well - not just during installation.

I'm worried that if I keep SystemVersion.plist at 10.9.2 indefinitely it would ruin other parts of the system such as App Store updates and the like.

So my idea now, is to try and find some method or tool, to block the app from being able to even read SystemVersion.plist entirely - think of it as a 'file system' version of Little Snitch if you will - just some way to create custom rules, for specific processes, that disallow read and/or write access, to specific files/folders in the system.

Maybe it would just cause the app to throw an error and not run at all (I could probably test this by temporarily moving the plist file to Trash for just 30 seconds while trying to install/run it) - but in either case, I think it's a really useful thing to be able to have, for powerful security purposes - just like the custom-blocking network access for apps in Little Snitch.

So is there some awesome third party tool, or even native OS X / Xcode tool, that can do this? Any insights as to what would even need to happen anyway, system/programming-wise? Tweaking with 'Sharing &amp; Persimmons' for a file in Finder lets me control user access, but not process.
You could just use the built-in sandboxing features of Mac OS X.

Create a custom profile that limits access to the SystemVersion.plist file, using syntax like this:

(version 1)
(deny file* (literal "/System/Library/CoreServices/SystemVersion.plist"))
(allow default)


Save that as for example ~/myprofile.sb and then run your program like this:

sandbox-exec -f ~/myprofile.sb "/Application/My Program.app/Contents/MacOS/My Program"