Disable network in sandboxes by default

.bazelrc

@@ -23,6 +23,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

examples/crate_universe/.bazelrc

@@ -26,6 +26,9 @@ build --nolegacy_external_runfiles
 # https://github.com/bazelbuild/bazel/issues/23043.
 build --incompatible_autoload_externally=
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Bzlmod
 ###############################################################################

extensions/bindgen/.bazelrc

@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

extensions/mdbook/.bazelrc

@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

extensions/prost/.bazelrc

@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

extensions/protobuf/.bazelrc

@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

extensions/wasm_bindgen/.bazelrc

@@ -25,6 +25,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################

ffi/rs/allocator_library/empty.rs

@@ -0,0 +1 @@
+

ffi/rs/global_allocator_library/empty.rs

@@ -0,0 +1 @@
+

ffi/rs/global_allocator_library/global_allocator_library.rs

@@ -35,7 +35,6 @@ fn __rust_alloc_error_handler(size: usize, align: usize) {
     }
 }
 
-
 // New feature as of https://github.com/rust-lang/rust/pull/88098.
 // This symbol is normally emitted by rustc. 0 means OOMs should abort, 1 means OOMs should panic.
 #[linkage = "weak"]

test/cargo_build_script/build_script_env_files/build.rs

@@ -1,3 +1,6 @@
 fn main() {
-    println!("cargo:rustc-env=FROM_BUILD_SCRIPT={}", std::env::var("GREETING").unwrap());
+    println!(
+        "cargo:rustc-env=FROM_BUILD_SCRIPT={}",
+        std::env::var("GREETING").unwrap()
+    );
 }

test/cargo_build_script/tools_exec/build.rs

@@ -48,7 +48,8 @@ fn main() {
     for env_var in &["CARGO", "CC", "CXX", "LD", "RUSTC"] {
         let path = std::env::var(env_var)
             .unwrap_or_else(|err| panic!("Error getting {}: {}", env_var, err));
-        std::process::Command::new(&path).status()
+        std::process::Command::new(&path)
+            .status()
             .unwrap_or_else(|err| panic!("Error executing {}: {}", path, err));
     }