Jeremy Rose d84ebff592 Preserve macOS Seatbelt exclusions in scratch directories (#46571) ...

## Why

Implicit temporary-directory grants can bypass filesystem restrictions and
protected project metadata. Moving an ancestor can also relocate protected
paths beyond their pathname exclusions.

## What changed

- Route process scratch access through the normal Seatbelt exclusion rules so
  it respects unreadable paths, read-only paths, and protected project metadata.
- Protect the parents of both logical symlink paths and their resolved targets
  against relocation.
- Apply privileged daemon socket protections after all grants, deny access to
  the socket directory itself, and prevent ancestor removal or renaming while
  allowing sibling writes.

GitOrigin-RevId: f4cbcf5867e204b0cded0812aac1851b3d444328

2026-09-19 01:59:07 +00:00

..

src

Preserve macOS Seatbelt exclusions in scratch directories (#46571)

2026-09-19 01:59:07 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00