aaronl-openai 2e1003728c Support Unix socket allowlists in macOS sandbox (#17654) ...

## Changes

Allows sandboxes to restrict overall network access while granting
access to specific unix sockets on mac.

## Details

- `codex sandbox macos`: adds a repeatable `--allow-unix-socket` option.
- `codex-sandboxing`: threads explicit Unix socket roots into the macOS
Seatbelt profile generation.
- Preserves restricted network behavior when only Unix socket IPC is
requested, and preserves full network behavior when full network is
already enabled.

## Verification

- `cargo test -p codex-cli -p codex-sandboxing`
- `cargo build -p codex-cli --bin codex`
- verified that `codex sandbox macos --allow-unix-socket /tmp/test.sock
-- test-client` grants access as expected

2e1003728c · 2026-04-15 00:53:24 -07:00

History

..

src

Support Unix socket allowlists in macOS sandbox (#17654)

2026-04-15 00:53:24 -07:00

BUILD.bazel

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

Cargo.toml

Support Unix socket allowlists in macOS sandbox (#17654)

2026-04-15 00:53:24 -07:00