Jeremy Rose 04e4d2b40f Block mutating fcntls in restricted macOS Seatbelt policies (#46500) ...

## Why

`F_MAKECOMPRESSED` and `F_TRANSFEREXTENTS` can mutate files through read-only descriptors, bypassing `file-write*` and `file-ioctl` restrictions. Even a deny-default Seatbelt policy needs an explicit denial for these operations.

## What changed

Deny `system-fcntl` commands `80` and `110` whenever the filesystem sandbox policy lacks full disk write access.

## Testing

Add macOS regression tests that run Seatbelt children under read-only and workspace-write policies, assert both operations fail with `EPERM`, and verify file contents and metadata remain unchanged. An unrestricted positive control verifies the mutations, allowing for unsupported extent transfers.

GitOrigin-RevId: 7a7a5ef30f9ff658a86071b51f1f7b4952d5cdad

2026-09-18 23:07:12 +00:00

..

src

Block mutating fcntls in restricted macOS Seatbelt policies (#46500)

2026-09-18 23:07:12 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00