Winston Howes 228ae3da8d Allow macOS TLS trust evaluation in network-enabled Seatbelt profiles (#48565) ...

## Why

System libcurl needs access to `com.apple.TrustEvaluationAgent` for TLS, but Seatbelt network profiles did not allow lookup of this service.

## What changed

Allow `mach-lookup` for this service when unrestricted networking is enabled or a restricted profile permits proxy ports or local binding. Keep access denied for network-disabled, Unix-socket-only, and managed profiles without usable endpoints.

## Testing

Add macOS regression tests that apply Seatbelt policies and check trust-service access and loopback connections without external network dependencies. Cover managed-network overrides and verify that unrelated service lookups and connections to unapproved ports remain denied.

GitOrigin-RevId: 8b190d6181fe1321186837557caa379275abfaee

2026-09-26 23:08:50 +00:00

..

src

Allow macOS TLS trust evaluation in network-enabled Seatbelt profiles (#48565)

2026-09-26 23:08:50 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00