Michael Bolin
034d874495
linux-sandbox: plumb split sandbox policies through helper
2026-03-06 13:25:10 -08:00
Michael Bolin
6888940e93
seatbelt: honor split filesystem sandbox policies
2026-03-06 13:25:10 -08:00
Michael Bolin
3cec98b309
safety: honor filesystem policy carveouts in apply_patch
2026-03-06 13:25:10 -08:00
Michael Bolin
a8d36af90e
protocol: derive effective file access from filesystem policies
2026-03-06 13:25:10 -08:00
Michael Bolin
0d783d6e51
Merge 6ae22b1aef into sapling-pr-archive-bolinfest
2026-03-06 13:14:02 -08:00
Michael Bolin
26814b8be5
sandboxing: plumb split sandbox policies through runtime
2026-03-06 13:13:55 -08:00
Michael Bolin
6ae22b1aef
config: add v3 filesystem permission profiles
2026-03-06 13:13:54 -08:00
Michael Bolin
85b3f50e37
merge commit for archive created by Sapling
2026-03-06 13:07:04 -08:00
Michael Bolin
1a12cb5f3e
config: add v3 filesystem permission profiles
2026-03-06 13:06:57 -08:00
viyatb-oai
9a4787c240
fix: reject global wildcard network proxy domains ( #13789 )
...
## Summary
- reject the global `*` domain pattern in proxy allow/deny lists and
managed constraints introduced for testing earlier
- keep exact hosts plus scoped wildcards like `*.example.com` and
`**.example.com`
- update docs and regression tests for the new invalid-config behavior
2026-03-06 21:06:24 +00:00
Michael Bolin
964fa6465a
merge commit for archive created by Sapling
2026-03-06 13:03:59 -08:00
Michael Bolin
05e4d082da
linux-sandbox: honor split filesystem policies in bwrap
2026-03-06 13:03:45 -08:00
Michael Bolin
b3a21ce009
protocol: keep root carveouts sandboxed
2026-03-06 13:03:45 -08:00
Michael Bolin
a9702e8e65
sandboxing: preserve denied paths when widening permissions
2026-03-06 13:03:45 -08:00
Michael Bolin
7c42582572
linux-sandbox: plumb split sandbox policies through helper
2026-03-06 13:03:45 -08:00
Michael Bolin
8451b4754d
seatbelt: honor split filesystem sandbox policies
2026-03-06 13:03:45 -08:00
Michael Bolin
b1aa31b0ff
safety: honor filesystem policy carveouts in apply_patch
2026-03-06 13:03:45 -08:00
Michael Bolin
36eee0e95b
protocol: derive effective file access from filesystem policies
2026-03-06 13:03:45 -08:00
Michael Bolin
b4e9baaaff
sandboxing: plumb split sandbox policies through runtime
2026-03-06 13:03:45 -08:00
Michael Bolin
929eeaf2c9
config: add v3 filesystem permission profiles
2026-03-06 13:03:45 -08:00
Michael Bolin
f3af2e32b0
Merge bfc71971a8 into sapling-pr-archive-bolinfest
2026-03-06 12:27:06 -08:00
Michael Bolin
bfc71971a8
linux-sandbox: honor split filesystem policies in bwrap
2026-03-06 12:26:59 -08:00
Michael Bolin
a8119dae5f
protocol: keep root carveouts sandboxed
2026-03-06 12:26:59 -08:00
Michael Bolin
7c35d14add
sandboxing: preserve denied paths when widening permissions
2026-03-06 12:26:59 -08:00
Michael Bolin
082fff3668
linux-sandbox: plumb split sandbox policies through helper
2026-03-06 12:26:59 -08:00
Michael Bolin
f0f11deed7
seatbelt: honor split filesystem sandbox policies
2026-03-06 12:26:59 -08:00
Michael Bolin
e919dbaa59
safety: honor filesystem policy carveouts in apply_patch
2026-03-06 12:26:59 -08:00
Michael Bolin
ebe6f772ea
protocol: derive effective file access from filesystem policies
2026-03-06 12:26:59 -08:00
Michael Bolin
0e7b5f0102
sandboxing: plumb split sandbox policies through runtime
2026-03-06 12:26:59 -08:00
Michael Bolin
1fc282c77b
merge commit for archive created by Sapling
2026-03-06 12:19:12 -08:00
Michael Bolin
b91f578647
linux-sandbox: honor split filesystem policies in bwrap
2026-03-06 12:18:41 -08:00
Michael Bolin
92f5956964
protocol: keep root carveouts sandboxed
2026-03-06 12:18:41 -08:00
Michael Bolin
b54d693aac
sandboxing: preserve denied paths when widening permissions
2026-03-06 12:18:41 -08:00
Michael Bolin
e08629c93f
linux-sandbox: plumb split sandbox policies through helper
2026-03-06 12:18:40 -08:00
Michael Bolin
4a8859f768
seatbelt: honor split filesystem sandbox policies
2026-03-06 12:18:40 -08:00
Michael Bolin
da1d510cb9
safety: honor filesystem policy carveouts in apply_patch
2026-03-06 12:18:40 -08:00
Michael Bolin
e915ef6011
protocol: derive effective file access from filesystem policies
2026-03-06 12:18:40 -08:00
Michael Bolin
38dad30b3e
sandboxing: plumb split sandbox policies through runtime
2026-03-06 12:18:40 -08:00
Michael Bolin
3eb810e045
config: add v3 filesystem permission profiles
2026-03-06 12:12:48 -08:00
Michael Bolin
7a5aff4972
fix bazel build ( #13787 )
...
I believe this broke in https://github.com/openai/codex/pull/13772 .
2026-03-06 12:12:20 -08:00
Michael Bolin
eb3ffb3408
merge commit for archive created by Sapling
2026-03-06 12:03:03 -08:00
Michael Bolin
e1a0e6a0f9
linux-sandbox: honor split filesystem policies in bwrap
2026-03-06 11:58:25 -08:00
Michael Bolin
33c497357e
protocol: keep root carveouts sandboxed
2026-03-06 11:58:25 -08:00
Michael Bolin
89679ab7d9
sandboxing: preserve denied paths when widening permissions
2026-03-06 11:58:25 -08:00
Michael Bolin
6539a36b0e
linux-sandbox: plumb split sandbox policies through helper
2026-03-06 11:58:25 -08:00
Michael Bolin
9f2ff9fc4f
seatbelt: honor split filesystem sandbox policies
2026-03-06 11:58:25 -08:00
Michael Bolin
b9614d65cb
safety: honor filesystem policy carveouts in apply_patch
2026-03-06 11:58:25 -08:00
Michael Bolin
051a925654
protocol: derive effective file access from filesystem policies
2026-03-06 11:58:25 -08:00
Michael Bolin
609036a872
sandboxing: plumb split sandbox policies through runtime
2026-03-06 11:58:25 -08:00
Michael Bolin
974327befd
config: add v3 filesystem permission profiles
2026-03-06 11:58:25 -08:00
Michael Bolin