;; ---------------------------------------------------------------------------
;; Network
;; Outbound and inbound TCP/UDP + DNS.
;; Notably excludes communication with UNIX sockets (like docker.sock).
;; Source: 20-network.sb
;; ---------------------------------------------------------------------------

;; Threat-model note: blocking exfiltration/C2 is explicitly NOT a goal for this sandbox.
;; The goal here is reliable agent operation (package installs, API calls, web fetches, local servers).
;; 
;; Restricting inbound to loopback-only peers is also not a goal here,
;; which does not appear to be possible using Seatbelt. Users who need stricter
;; inbound boundaries should configure macOS Application Firewall or pf.

;; Outbound TCP/UDP connections.
(allow network-outbound (remote ip))
;; DNS resolution via mDNSResponder (required for hostname lookups).
(allow network-outbound (literal "/private/var/run/mDNSResponder"))

;; Inbound TCP/UDP connections.
;; Includes connections to local dev servers on 127.0.0.1 or 0.0.0.0.
(allow network-bind     (local  ip))
(allow network-inbound  (local  ip))