From 8a73f262858a71c5da87dd414c930ee9d3aee66d Mon Sep 17 00:00:00 2001 From: Dylan Hurd Date: Thu, 8 Jan 2026 03:06:58 -0800 Subject: [PATCH] fix(core) allow loopback by default in sandbox --- codex-rs/core/src/seatbelt_base_policy.sbpl | 8 ++++++++ codex-rs/core/src/seatbelt_network_policy.sbpl | 3 +++ 2 files changed, 11 insertions(+) diff --git a/codex-rs/core/src/seatbelt_base_policy.sbpl b/codex-rs/core/src/seatbelt_base_policy.sbpl index 236f7a1398..ed12493396 100644 --- a/codex-rs/core/src/seatbelt_base_policy.sbpl +++ b/codex-rs/core/src/seatbelt_base_policy.sbpl @@ -18,6 +18,14 @@ ; process-info (allow process-info* (target same-sandbox)) +; Allow loopback-only sockets for local servers/clients. +(allow network-bind + (local ip "localhost:*")) +(allow network-inbound + (local ip "localhost:*")) +(allow network-outbound + (remote ip "localhost:*")) + (allow file-write-data (require-all (path "/dev/null") diff --git a/codex-rs/core/src/seatbelt_network_policy.sbpl b/codex-rs/core/src/seatbelt_network_policy.sbpl index 2a72f95fd3..34e1482611 100644 --- a/codex-rs/core/src/seatbelt_network_policy.sbpl +++ b/codex-rs/core/src/seatbelt_network_policy.sbpl @@ -1,6 +1,9 @@ ; when network access is enabled, these policies are added after those in seatbelt_base_policy.sbpl ; Ref https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/network.sb;drc=f8f264d5e4e7509c913f4c60c2639d15905a07e4 +(allow network-bind + (local ip "localhost:*")) + (allow network-outbound) (allow network-inbound) (allow system-socket)