iceweasel-oai f11d0dd012 Prevent filesystem-root read denies in the Windows sandbox (#44327) ...

## Why

The elevated Windows sandbox requires effective `:root` read access and cannot safely enforce policies that deny reads at the filesystem root.

## What changed

- Validate root read access before elevated setup, service provisioning, and setup refresh, rejecting root-denying globs before expansion.
- Reject filesystem-root deny-read ACL targets after canonicalization and check the opened handle before applying an ACL, so aliases cannot bypass the root guard.
- Read and update deny ACLs through the same handle, and allow an existing deny ACE to be recognized when write access to the ACL is unavailable.

## Testing

Add regression coverage for default root denial, root-denying globs, allowed root reads with narrower deny rules, handle-based root detection, and reading existing deny ACEs without `WRITE_DAC`.

GitOrigin-RevId: b904e7cdbc09ee0147e1818c898b0382b5820c1b

2026-09-09 22:50:03 +00:00

..

common

Remove the unused legacy remote compaction implementation (#44273)

2026-09-09 18:40:53 +00:00

remote_env_windows

Apply remote platform semantics to exec safety checks (#42113)

2026-09-01 18:24:56 +00:00

suite

Prevent filesystem-root read denies in the Windows sandbox (#44327)

2026-09-09 22:50:03 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00