viyatb-oai c18db9ba69 Honor prepared Unix socket permissions in Seatbelt (#45548) ...

## Why

Seatbelt ignored Unix socket permissions in `ManagedNetworkSandboxContext`, which could omit allowed sockets or inherit a live proxy's broader permissions.

## What changed

Use the prepared context's `allow_unix_sockets` and `dangerously_allow_all_unix_sockets` settings when present, falling back to the live proxy only when no prepared context exists. Normalize allowlisted paths and preserve explicit extra socket allowances.

## Testing

Add regression coverage for prepared-policy precedence, empty allowlists, invalid relative paths, and explicit extra allowances. Extend macOS exec-server tests to cover prepared and executor-local proxy socket permissions, including explicit allow-all behavior without unrestricted network access.

GitOrigin-RevId: 3372e1f2f1b161e60bde585db8d70b4e3a0b1854

2026-09-14 23:52:16 +00:00

..

src

Honor prepared Unix socket permissions in Seatbelt (#45548)

2026-09-14 23:52:16 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Wire up the native Windows MXC helper entry point (#44903)

2026-09-11 20:10:02 +00:00