sandbox-exec: deny network access but allow socket

Question

I am using MacOSX's sandbox-exec to deny network access for a command (like e.g. described in this article).

Unfortunately this also seems to deny MySQL access to it's socket:

Can't connect to local MySQL server through socket '/tmp/mysql.sock'

The profile-file for sandbox-exec is this:

(version 1)
(allow default)
(deny network*)

Is there a way to restrict only TCP/internet network access but leave socket access unchanged?

Answer 1

Found out. The profile file has to contain (allow network-outbound (to unix-socket)):

(version 1)
(allow default)
(deny network*)
(allow network-outbound (to unix-socket))