Remove the allowNetwork option from SandboxProfile and instead add a comment about wanting to add this functionality in the future (it needs to be done in a more nuanced way).

Author: abertelrud

Sources/Basics/SandboxProfile.swift

@@ -11,7 +11,9 @@
 import Foundation
 import TSCBasic
 
-/// A sandbox profile representing the desired restrictions. The implementation can vary between platforms.
+/// A sandbox profile representing the desired restrictions. The implementation can vary between platforms. Currently
+/// the only control a client has is in the path rules, but in the future there should also be options for controlling
+/// blocking of network access and process launching.
 public struct SandboxProfile: Equatable {
     /// An ordered list of path rules, where the last rule to cover a particular path "wins". These will be resolved
     /// to absolute paths at the time the profile is applied. They are applied after any of the implicit directories
@@ -25,14 +27,10 @@ public struct SandboxProfile: Equatable {
         case writable(AbsolutePath)
     }
 
-    /// Whether to allow outbound and inbound network access.
-    public var allowNetwork: Bool
-
     /// Configures a SandboxProfile for blocking network access and writing to the file system except to specifically
     /// permitted locations.
-    public init(_ pathAccessRules: [PathAccessRule] = [], allowNetwork: Bool = false) {
+    public init(_ pathAccessRules: [PathAccessRule] = []) {
         self.pathAccessRules = pathAccessRules
-        self.allowNetwork = allowNetwork
     }
 }
 
@@ -66,12 +64,6 @@ fileprivate extension SandboxProfile {
         // Allow operations on subprocesses.
         contents += "(allow process*)\n"
 
-        // Optionally allow network access (inbound and outbound).
-        if allowNetwork {
-            contents += "(system-network)\n"
-            contents += "(allow network*)\n"
-        }
-
         // Allow reading any file that isn't protected by TCC or permissions (ideally we'd only allow a specific set
         // of readable locations, and can maybe tighten this in the future).
         contents += "(allow file-read*)\n"

Tests/BasicsTests/SandboxTests.swift

@@ -20,7 +20,6 @@ final class SandboxTest: XCTestCase {
     func testDefaults() throws {
         let sandboxProfile = SandboxProfile()
         XCTAssertEqual(sandboxProfile.pathAccessRules, [])
-        XCTAssertEqual(sandboxProfile.allowNetwork, false)
     }
 
     func testSandboxOnAllPlatforms() throws {