External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

test(sandbox): darwin end-to-end lockdown enforcement test (#374)

Browse Source
This commit is contained in:
Abhisek Datta
2026-07-10 23:01:36 +05:30
committed by GitHub
parent ed614812f5
commit 5e0670266e
3 changed files with 270 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/platform/seatbelt_translator_darwin.go
+14 -3
View File
@@ -644,11 +644,22 @@ func (t *seatbeltPolicyTranslator) translateNetwork(policy *sandbox.SandboxPolic
sb.WriteString("\"))\n")
}
// macOS resolves names via the /var/run/mDNSResponder unix socket,
// which the deny above covers; the proxy resolves names, so direct
// DNS stays closed unless explicitly re-opened.
// Bind rules cannot cover outbound connects (the local address is
// unbound at connect() time), so loopback outbound is re-opened
// explicitly for bind-enabled profiles.
if utils.SafelyGetValue(policy.AllowNetworkBind) {
sb.WriteString("(allow network-outbound (remote ip \"localhost:*\"))\n")
}
// getaddrinfo resolves via the com.apple.dnssd.service XPC endpoint,
// legacy clients use the mDNSResponder socket (both /var and resolved
// /private/var paths — Seatbelt matches resolved paths), and
// self-resolving clients need direct port 53.
if utils.SafelyGetValue(policy.AllowDirectDNS) {
sb.WriteString("(allow mach-lookup (global-name \"com.apple.dnssd.service\"))\n")
sb.WriteString("(allow network-outbound (remote unix-socket (path-literal \"/var/run/mDNSResponder\")))\n")
sb.WriteString("(allow network-outbound (remote unix-socket (path-literal \"/private/var/run/mDNSResponder\")))\n")
sb.WriteString("(allow network-outbound (remote ip \"*:53\"))\n")
}
sb.WriteString("\n")