Jeremy Rose d84ebff592
Preserve macOS Seatbelt exclusions in scratch directories ( #46571 ) ...
## Why
Implicit temporary-directory grants can bypass filesystem restrictions and
protected project metadata. Moving an ancestor can also relocate protected
paths beyond their pathname exclusions.
## What changed
- Route process scratch access through the normal Seatbelt exclusion rules so
it respects unreadable paths, read-only paths, and protected project metadata.
- Protect the parents of both logical symlink paths and their resolved targets
against relocation.
- Apply privileged daemon socket protections after all grants, deny access to
the socket directory itself, and prevent ancestor removal or renaming while
allowing sibling writes.
GitOrigin-RevId: f4cbcf5867e204b0cded0812aac1851b3d444328
2026-09-19 01:59:07 +00:00
2026-09-15 02:35:59 +00:00
2026-09-19 00:52:56 +00:00
2026-09-19 01:58:19 +00:00
2026-09-14 22:31:32 +00:00
2026-09-19 00:14:40 +00:00
2026-09-19 01:21:32 +00:00
2026-09-19 01:04:18 +00:00
2026-09-11 20:10:02 +00:00
2026-09-18 00:25:37 +00:00
2026-09-17 00:49:12 +00:00
2026-09-09 03:17:48 +00:00
2026-09-19 01:37:14 +00:00
2026-09-07 16:55:06 +00:00
2026-09-19 01:21:32 +00:00
2026-09-19 01:37:14 +00:00
2026-09-11 17:00:07 +00:00
2026-09-11 17:00:07 +00:00
2026-09-11 17:00:07 +00:00
2026-09-15 18:52:15 +00:00
2026-09-19 01:36:53 +00:00
2026-09-15 17:32:33 +00:00
2026-09-19 00:46:30 +00:00
2026-09-14 19:12:59 +00:00
2026-09-18 00:59:10 +00:00
2026-09-05 01:25:06 +00:00
2026-09-19 01:37:14 +00:00
2026-09-15 18:23:08 +00:00
2026-09-18 22:40:37 +00:00
2026-09-19 01:56:57 +00:00
2026-09-11 01:57:54 +00:00
2026-09-19 01:49:01 +00:00
2026-09-05 12:17:32 +00:00
2026-09-19 01:58:19 +00:00
2026-09-19 01:27:02 +00:00
2026-09-17 04:37:54 +00:00
2026-09-19 01:49:01 +00:00
2026-09-17 04:23:45 +00:00
2026-09-19 01:37:14 +00:00
2026-09-18 23:07:36 +00:00
2026-09-19 01:21:32 +00:00
2026-09-06 20:52:29 +00:00
2026-09-17 18:56:26 +00:00
2026-09-17 10:02:38 +00:00
2026-09-10 00:26:30 +00:00
2026-09-19 01:37:14 +00:00
2026-09-11 21:59:24 +00:00
2026-09-19 01:21:32 +00:00
2026-09-19 01:37:14 +00:00
2026-09-17 19:42:56 +00:00
2026-09-16 23:26:00 +00:00
2026-09-19 01:58:43 +00:00
2026-09-19 01:36:53 +00:00
2026-09-19 01:36:53 +00:00
2026-09-19 00:00:01 +00:00
2026-09-19 01:21:32 +00:00
2026-09-16 22:43:57 +00:00
2026-09-19 01:49:01 +00:00
2026-09-19 00:18:56 +00:00
2026-09-19 01:27:26 +00:00
2026-09-11 03:16:01 +00:00
2026-09-17 21:25:55 +00:00
2026-09-18 23:59:18 +00:00
2026-09-18 22:29:16 +00:00
2026-09-19 01:59:07 +00:00
2026-09-17 23:35:32 +00:00
2026-09-15 18:06:03 +00:00
2026-09-09 04:00:10 +00:00
2026-09-05 05:21:42 +00:00
2026-09-15 02:33:27 +00:00
2026-09-16 09:03:41 +00:00
2026-09-19 00:52:56 +00:00
2026-09-16 22:33:15 +00:00
2026-09-17 19:34:45 +00:00
2026-09-19 01:58:19 +00:00
2026-09-16 16:56:41 +00:00
2026-09-08 00:13:28 +00:00
2026-09-18 23:59:18 +00:00
2026-09-11 22:09:02 +00:00
2026-09-18 23:17:17 +00:00
2026-09-19 01:21:32 +00:00
2026-09-18 00:36:07 +00:00
2026-09-13 18:53:06 +00:00
2026-09-08 21:19:02 +00:00
2026-09-19 00:46:06 +00:00
2026-09-16 23:26:00 +00:00
2026-09-11 06:45:09 +00:00
d84ebff592