From 78245b47af2a7aafcabe025828ceecca69db4df1 Mon Sep 17 00:00:00 2001
From: Jeremy Rose <172423086+nornagon-openai@users.noreply.github.com>
Date: Sat, 19 Sep 2026 02:56:24 +0000
Subject: [PATCH] Deny XPC service lookups in macOS Seatbelt profiles (#46583)

GitOrigin-RevId: 76d9deb2ea5ddf32b165b42d538e797c38bcdfc1
---
 codex-rs/sandboxing/src/seatbelt.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/codex-rs/sandboxing/src/seatbelt.rs b/codex-rs/sandboxing/src/seatbelt.rs
index 8a96fe4a5e..3597649f8a 100644
--- a/codex-rs/sandboxing/src/seatbelt.rs
+++ b/codex-rs/sandboxing/src/seatbelt.rs
@@ -1067,6 +1067,7 @@ pub(crate) fn create_seatbelt_command_args_with_profile(
             .map_err(|error| SeatbeltPreparationError::FileSystem(error.to_string()))?;
         policy_sections.push(daemon::protection_policy(&directory)?);
     }
+    policy_sections.push("(deny mach-lookup (xpc-service-name-prefix \"\"))".to_string());
     policy_sections.push(deny_read_policy);
     // Renaming an allowed ancestor relocates its protected descendants past
     // their pathname carveouts. Keep these denies last so no broader allowance