From 892b35fcfb6ab8e192e51c603583279c99e8b0a4 Mon Sep 17 00:00:00 2001 From: Om Patel Date: Mon, 6 Jul 2026 12:37:39 -0400 Subject: [PATCH] fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox (#28221) Co-authored-by: David Pierce --- packages/cli/src/utils/sandbox-macos-permissive-open.sb | 1 - packages/cli/src/utils/sandbox-macos-permissive-proxied.sb | 1 - packages/cli/src/utils/sandbox-macos-restrictive-open.sb | 1 - packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb | 1 - packages/cli/src/utils/sandbox-macos-strict-open.sb | 1 - packages/cli/src/utils/sandbox-macos-strict-proxied.sb | 1 - 6 files changed, 6 deletions(-) diff --git a/packages/cli/src/utils/sandbox-macos-permissive-open.sb b/packages/cli/src/utils/sandbox-macos-permissive-open.sb index 2874e963ff..73b70212ee 100644 --- a/packages/cli/src/utils/sandbox-macos-permissive-open.sb +++ b/packages/cli/src/utils/sandbox-macos-permissive-open.sb @@ -12,7 +12,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (subpath (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) diff --git a/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb b/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb index 8becc8cbd3..61e09d4e17 100644 --- a/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb +++ b/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb @@ -12,7 +12,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (subpath (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) diff --git a/packages/cli/src/utils/sandbox-macos-restrictive-open.sb b/packages/cli/src/utils/sandbox-macos-restrictive-open.sb index 17f272243d..e4ae24dfb5 100644 --- a/packages/cli/src/utils/sandbox-macos-restrictive-open.sb +++ b/packages/cli/src/utils/sandbox-macos-restrictive-open.sb @@ -70,7 +70,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (subpath (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) diff --git a/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb b/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb index c07c1496b5..217340cf5f 100644 --- a/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb +++ b/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb @@ -70,7 +70,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (subpath (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) diff --git a/packages/cli/src/utils/sandbox-macos-strict-open.sb b/packages/cli/src/utils/sandbox-macos-strict-open.sb index e5cbd1b334..ed7cfeeb84 100644 --- a/packages/cli/src/utils/sandbox-macos-strict-open.sb +++ b/packages/cli/src/utils/sandbox-macos-strict-open.sb @@ -105,7 +105,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (literal (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) diff --git a/packages/cli/src/utils/sandbox-macos-strict-proxied.sb b/packages/cli/src/utils/sandbox-macos-strict-proxied.sb index 53b102f43e..1355163b04 100644 --- a/packages/cli/src/utils/sandbox-macos-strict-proxied.sb +++ b/packages/cli/src/utils/sandbox-macos-strict-proxied.sb @@ -105,7 +105,6 @@ (subpath (string-append (param "HOME_DIR") "/.gemini")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) - (literal (string-append (param "HOME_DIR") "/.gitconfig")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1"))