openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-20 12:47:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deny XPC service lookups in macOS Seatbelt profiles (#46583)

Browse Source 
GitOrigin-RevId: 76d9deb2ea5ddf32b165b42d538e797c38bcdfc1
This commit is contained in:
Jeremy Rose
2026-09-19 02:56:24 +00:00
committed by copyberry
parent ed12cc75d3
commit 78245b47af
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
codex-rs/sandboxing/src/seatbelt.rs
View File

@@ -1067,6 +1067,7 @@ pub(crate) fn create_seatbelt_command_args_with_profile(
.map_err(|error| SeatbeltPreparationError::FileSystem(error.to_string()))?;
policy_sections.push(daemon::protection_policy(&directory)?);
}
policy_sections.push("(deny mach-lookup (xpc-service-name-prefix \"\"))".to_string());
policy_sections.push(deny_read_policy);
// Renaming an allowed ancestor relocates its protected descendants past
// their pathname carveouts. Keep these denies last so no broader allowance