viyatb-oai 99914f4950 Honor explicit Unix socket grants in the Linux managed sandbox (#45534) ...

## Why

Linux proxy-routed sandboxing denied standalone Unix sockets even when the effective network policy enabled `dangerously_allow_all_unix_sockets`.

## What changed

- Carry Unix socket permissions in `ManagedNetworkSandboxContext` and pass the prepared context through Linux sandbox launches with `--managed-network`.
- Allow `AF_UNIX` socket creation in proxy-routed mode when `dangerously_allow_all_unix_sockets` is enabled, while preserving network namespace isolation and restrictions on other socket families.
- Keep standalone Unix sockets denied by default and for path-only grants. Default missing fields in older serialized contexts to restrictive values.

## Testing

Add coverage for policy preparation and transport, legacy deserialization, and malformed policy rejection. Add a Linux integration test covering default denial, path-only denial, and explicit allow-all access, while checking that direct TCP access and `AF_NETLINK`/`AF_VSOCK` sockets remain blocked.

GitOrigin-RevId: 2695b945ad3e59fcb3faf7662d852a26650af16c

2026-09-14 22:40:20 +00:00

..

e2e_benches

bench: add codex help e2e macrobenchmark (#31295)

2026-07-09 17:23:44 -07:00

src

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

tests

Resolve enterprise-managed MCP registrations in the catalog (#45459)

2026-09-14 16:30:00 +00:00

BUILD.bazel

Isolate Bazel build commit metadata from Rust compilation inputs (#43304)

2026-09-06 23:49:46 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

Add manual callback input to MCP OAuth login (#44629)

2026-09-10 19:51:52 +00:00