mirror of
https://github.com/openai/codex.git
synced 2026-05-02 10:26:45 +00:00
2e1003728c
## Changes Allows sandboxes to restrict overall network access while granting access to specific unix sockets on mac. ## Details - `codex sandbox macos`: adds a repeatable `--allow-unix-socket` option. - `codex-sandboxing`: threads explicit Unix socket roots into the macOS Seatbelt profile generation. - Preserves restricted network behavior when only Unix socket IPC is requested, and preserves full network behavior when full network is already enabled. ## Verification - `cargo test -p codex-cli -p codex-sandboxing` - `cargo build -p codex-cli --bin codex` - verified that `codex sandbox macos --allow-unix-socket /tmp/test.sock -- test-client` grants access as expected
31 lines
750 B
TOML
31 lines
750 B
TOML
[package]
|
|
name = "codex-sandboxing"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_sandboxing"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-network-proxy = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
dunce = { workspace = true }
|
|
libc = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
url = { workspace = true }
|
|
which = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt"] }
|