Sandbox file-read config is cached and no longer crashes when the native lookup fails.
What's wrong with this entry?
getFsReadConfig memoises its result per config object, and a throw from the native call is logged and recovered from rather than propagated.
- result is cached keyed on the config object, so repeated calls skip the native work
- on throw, deny/allow lists are synthesised from the raw filesystem deny lists plus credential file paths
- the failure is logged rather than surfaced to the caller
[sandbox] getFsReadConfig threw; falling back to raw deny lists:
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.236
macOS sandbox re-applies read and delete denials inside writable folders
Both mention sandbox
-
v2.1.236
Sandbox proxy no longer writes to sockets that have gone away
Both mention sandbox
-
v2.1.236
IPv6 hosts through the proxy
Both mention sandbox