viyatb-oai 36cd163504 [codex] Allow PyTorch libomp shm in Seatbelt (#16945) ...

## Summary
- Add a targeted macOS Seatbelt allow rule for PyTorch/libomp KMP
registration shared-memory objects.
- Scope the rule to read/create/unlink operations on names matching
`^/__KMP_REGISTERED_LIB_[0-9]+$`.
- Add a base-policy regression assertion in `seatbelt_tests.rs`.

## Why
Importing PyTorch on macOS under the Codex sandbox can abort when libomp
attempts to create the KMP registration POSIX shm object and Seatbelt
denies `ipc-posix-shm-write-create`.

## Validation
- `just fmt`
- `cargo test -p codex-sandboxing`
- `cargo clippy -p codex-sandboxing --all-targets`
- `just argument-comment-lint`
- `git diff --check`
- End-to-end PyTorch import under `codex sandbox macos` exited `0` with
no KMP shm denial
- `cargo clean`

36cd163504 · 2026-04-06 22:12:30 +00:00

History

..

src

[codex] Allow PyTorch libomp shm in Seatbelt (#16945)

2026-04-06 22:12:30 +00:00

BUILD.bazel

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

Cargo.toml

permissions: remove macOS seatbelt extension profiles (#15918)

2026-03-26 17:12:45 -07:00