jif 8bbe8f8702 Fix read-only metadata mount ordering for nested writable roots (#47623) ...

## Why

Nested writable roots must allow the Linux sandbox to start while preserving read-only metadata protections, including when a writable directory sits beneath a read-only `.codex` directory.

## What changed

Defer read-only subpath mounts shared with a deeper writable root until that root is bound. Keep symlink target remapping and writable-symlink validation for deferred paths so mount ordering does not bypass those checks.

## Testing

Add regression coverage for mounting `.git`, `.agents`, and `.codex` metadata exactly once after the nested writable bind. Add sandbox integration cases for ordinary and symlinked roots, using both parent and nested working directories, to verify startup, allowed writes, metadata protection, and temporary mountpoint cleanup.

GitOrigin-RevId: 45e439eaf537e10bfa8b839bad816b0401fb65aa

2026-09-23 18:51:35 +00:00

..

bundled_bwrap.rs

Verify bundled bwrap in Bazel builds (#38494)

2026-08-14 05:03:39 +00:00

daemon_sockets_tests.rs

Mask daemon socket paths exposed through ancestor bind mounts (#47079)

2026-09-21 18:04:14 +00:00

landlock.rs

Fix read-only metadata mount ordering for nested writable roots (#47623)

2026-09-23 18:51:35 +00:00

managed_proxy_unix_sockets_tests.rs

Share platform identity across path, network, and sandbox configuration (#46334)

2026-09-18 00:51:34 +00:00

managed_proxy.rs

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00

mod.rs

Verify bundled bwrap in Bazel builds (#38494)

2026-08-14 05:03:39 +00:00

nested_metadata_tests.rs

Fix read-only metadata mount ordering for nested writable roots (#47623)

2026-09-23 18:51:35 +00:00

wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00