viyatb-oai 696b4502df Allow semaphore limit queries in the macOS sandbox (#39976) ...

## Why

Python's `ProcessPoolExecutor` queries `SEM_NSEMS_MAX` through `sysconf`, which reads the `kern.sysv.semmns` sysctl on macOS.

## What changed

- Allow reads of `kern.sysv.semmns` in the base Seatbelt policy.
- Verify `/usr/bin/getconf SEM_NSEMS_MAX` succeeds with both read-only and workspace-write sandbox policies.

GitOrigin-RevId: ab3ae92dc8991729f90a47c1994eedb6c7a2b9cd

2026-08-21 17:16:51 +00:00

..

bwrap_tests.rs

Fix rust-ci-full failures due to missing bwrap (#21604)

2026-05-08 09:52:19 -07:00

bwrap.rs

Fix rust-ci-full failures due to missing bwrap (#21604)

2026-05-08 09:52:19 -07:00

denial.rs

Sandbox remote apply_patch operations (#38043)

2026-08-11 17:47:22 +00:00

landlock_tests.rs

Enforce configured network proxy in codex sandbox (#27035)

2026-06-08 14:03:37 -07:00

landlock.rs

Enforce configured network proxy in codex sandbox (#27035)

2026-06-08 14:03:37 -07:00

lib.rs

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

manager_tests.rs

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

manager.rs

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

policy_transforms_tests.rs

Require fresh approval beneath denied permission paths (#39266)

2026-08-18 19:17:09 +00:00

policy_transforms.rs

Require fresh approval beneath denied permission paths (#39266)

2026-08-18 19:17:09 +00:00

restricted_read_only_platform_defaults.sbpl

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

seatbelt_base_policy.sbpl

Allow semaphore limit queries in the macOS sandbox (#39976)

2026-08-21 17:16:51 +00:00

seatbelt_network_policy.sbpl

[sandboxing] Remove Darwin user cache write from Seatbelt network policy (#21443)

2026-05-08 16:43:07 +00:00

seatbelt_preferences_policy.sbpl

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

seatbelt_tests.rs

Allow semaphore limit queries in the macOS sandbox (#39976)

2026-08-21 17:16:51 +00:00

seatbelt.rs

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

spawn.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

violation_tests.rs

Record normalized sandbox violation events (#36207)

2026-07-30 19:23:33 +00:00

violation.rs

Record normalized sandbox violation events (#36207)

2026-07-30 19:23:33 +00:00

windows.rs

Honor the configured Windows sandbox level for managed networking (#37875)

2026-08-10 19:57:40 +00:00