diff --git a/sandbox/platform/seatbelt_translator_darwin.go b/sandbox/platform/seatbelt_translator_darwin.go index fe362d4..a8cfae6 100644 --- a/sandbox/platform/seatbelt_translator_darwin.go +++ b/sandbox/platform/seatbelt_translator_darwin.go @@ -203,6 +203,7 @@ func (t *seatbeltPolicyTranslator) translate(policy *sandbox.SandboxPolicy) (str sb.WriteString("(allow mach-lookup\n") sb.WriteString(" (global-name \"com.apple.audio.systemsoundserver\")\n") sb.WriteString(" (global-name \"com.apple.distributed_notifications@Uv3\")\n") + sb.WriteString(" (global-name \"com.apple.FSEvents\")\n") sb.WriteString(" (global-name \"com.apple.FontObjectsServer\")\n") sb.WriteString(" (global-name \"com.apple.fonts\")\n") sb.WriteString(" (global-name \"com.apple.logd\")\n") diff --git a/sandbox/platform/seatbelt_translator_darwin_test.go b/sandbox/platform/seatbelt_translator_darwin_test.go index 3f532da..05c2c13 100644 --- a/sandbox/platform/seatbelt_translator_darwin_test.go +++ b/sandbox/platform/seatbelt_translator_darwin_test.go @@ -57,6 +57,16 @@ func TestSeatbeltTranslatorDarwinCommonTranslation(t *testing.T) { assert.Contains(t, actual, "(allow process-fork)") } +func TestSeatbeltTranslatorDarwinAlwaysAllowsFSEventsMachLookup(t *testing.T) { + policy := &sandbox.SandboxPolicy{} + + translator := newSeatbeltPolicyTranslator() + actual, err := translator.translate(policy) + require.NoError(t, err) + + assert.Contains(t, actual, `(global-name "com.apple.FSEvents")`) +} + func TestSeatbeltTranslatorDarwinFilesystemTranslation(t *testing.T) { cases := []struct { name string