Remove generated-default filesystem path variants (#33632)

## What changed

- Represent built-in filesystem policy entries with the same `Path` and
  `Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
  simplify elevated deny-write handling to rely on direct-runtime enforcement
  and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
  the reduced filesystem path model.

GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c
This commit is contained in:
pakrym-oai
2026-07-16 16:13:53 +00:00
committed by copyberry
parent 21c37fb374
commit 5a85351dfe
11 changed files with 61 additions and 341 deletions
@@ -153,13 +153,13 @@ fn render_file_system_entry(rendered: &mut String, entry: &FileSystemSandboxEntr
}
rendered.push_str("\">");
match &entry.path {
FileSystemPath::Path { path } | FileSystemPath::GeneratedDefaultPath { path } => {
FileSystemPath::Path { path } => {
push_text_element(rendered, "path", path.to_string_lossy().as_ref());
}
FileSystemPath::GlobPattern { pattern } => {
push_text_element(rendered, "glob", pattern);
}
FileSystemPath::Special { value } | FileSystemPath::GeneratedDefaultSpecial { value } => {
FileSystemPath::Special { value } => {
let value = render_special_path(value);
push_text_element(rendered, "special", &value);
}