Blocked network calls in the sandbox now tell you the host, port and reason.
What's wrong with this entry?
When the sandbox blocks an outbound connection, it records a violation naming the host, the port and a reason instead of silently failing. Reasons include sandbox policy unavailable, malformed host, host is on the deny list, host is not on the allow list, user denied, and permission prompt failed.
- Blocked HTTP requests get their own violation line with the URL query string redacted.
- A per-domain reason override can be supplied through
deniedDomainReasons. - Domain rules can now carry a
:portsuffix, matched against the port of the connection.
host is not on the allow list
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.236
macOS sandbox re-applies read and delete denials inside writable folders
Both mention sandbox
-
v2.1.236
Sandbox proxy no longer writes to sockets that have gone away
Both mention sandbox
-
v2.1.236
IPv6 hosts through the proxy
Both mention sandbox