Jeremy Rose 21facf2273 Restrict macOS preference reads to full-disk policies (#39811) ...

## Why

The macOS preferences service can expose data outside a sandbox's allowed
filesystem read roots.

## What changed

- Move the Seatbelt preference and `cfprefsd` grants into a separate policy
  section that is included only when filesystem reads are unrestricted.
- Remove the equivalent grants from the restricted platform defaults.

## Testing

- Verify both Seatbelt profiles include preference grants only for full-disk
  read policies, including policies with denied paths or globs.
- Verify a restricted sandbox cannot retrieve a preference whose plist is
  denied, while an unrestricted read policy can.

GitOrigin-RevId: 90388366a7302bca1830ad0439544be8babc7321

2026-08-20 23:18:55 +00:00

..

src

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

BUILD.bazel

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

Cargo.toml

Support Windows sandboxing in the exec server (#34423)

2026-07-20 22:35:14 +00:00