diff --git a/clientscr/res/BOINCSaver.xib b/clientscr/res/BOINCSaver.xib
index 5286b9392f..aa6a7c55ea 100644
--- a/clientscr/res/BOINCSaver.xib
+++ b/clientscr/res/BOINCSaver.xib
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="20037" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="21507" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
     <dependencies>
-        <deployment version="101003" identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="20037"/>
+        <deployment version="101304" identifier="macosx"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="21507"/>
         <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
     </dependencies>
     <objects>
diff --git a/clientscr/res/mac_restrict_access.sb b/clientscr/res/mac_restrict_access.sb
new file mode 100644
index 0000000000..39798b0a8d
--- /dev/null
+++ b/clientscr/res/mac_restrict_access.sb
@@ -0,0 +1,8 @@
+(version 1)
+(allow default)
+(deny file-read* (subpath "/Users") (subpath "/Volumes") (subpath "/private") (subpath "/etc") (subpath "/cores") (subpath "/opt") (subpath "/dev") (subpath "/var"))
+(deny file-write* (subpath "/Users") (subpath "/Volumes") (subpath "/private") (subpath "/etc") (subpath "/cores") (subpath "/opt") (subpath "/dev") (subpath "/var"))
+(deny file-read* (subpath "/Library/Application Support") )
+(deny file-write* (subpath "/Library/Application Support") )
+(allow file-write* (subpath "/Library/Application Support/BOINC Data") (subpath "/private/tmp") )
+(allow file-read* (subpath "/Library/Application Support/BOINC Data") (subpath "/private/tmp") )