viyatb-oai 8a474a6561 fix: unblock private DNS in macOS sandbox (#17370) ...

## Summary
- keep hostname targets proxied by default by removing hostname suffixes
from the managed `NO_PROXY` value while preserving private/link-local
CIDRs
- make the macOS `allow_local_binding` sandbox rules match the local
socket shape used by DNS tools by allowing wildcard local binds
- allow raw DNS egress to remote port 53 only when `allow_local_binding`
is enabled, without opening blanket outbound network access

## Root cause
Raw DNS tools do not honor `HTTP_PROXY` or `ALL_PROXY`, so the
proxy-only Seatbelt policy blocked their resolver traffic before it
could reach host DNS. In the affected managed config,
`allow_local_binding = true`, but the existing rule only allowed
`localhost:*` binds; `dig`/BIND can bind sockets in a way that needs
wildcard local binding. Separately, hostname suffixes in `NO_PROXY`
could force internal hostnames to resolve locally instead of through the
proxy path.

---------

Co-authored-by: Codex <noreply@openai.com>

2026-04-10 20:34:04 -07:00

..

src

fix: unblock private DNS in macOS sandbox (#17370)

2026-04-10 20:34:04 -07:00

BUILD.bazel

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

Cargo.toml

permissions: remove macOS seatbelt extension profiles (#15918)

2026-03-26 17:12:45 -07:00