codex

mirror of https://github.com/openai/codex.git synced 2026-10-22 17:58:46 +00:00

Files

T

Felipe Coury bd92b056dd Ignore inherited ACEs when refreshing Windows write roots (#34392 )

## Why

An inherited `FILE_DELETE_CHILD` grant can make a write root look stale, but
`SET_ACCESS` cannot replace an ACE inherited from an ancestor. Treating that
grant as explicit causes unnecessary ACL refresh attempts that cannot converge.

## What changed

- Add explicit-ACE filtering to the Windows DACL permission checks.
- Refresh a write root only when `FILE_DELETE_CHILD` is present in an explicit
  allow ACE, while retaining effective-permission checks for required rights.
- Ignore inherited stale rights when deciding whether `SET_ACCESS` must repair
  an allow ACE.

## Testing

Add a Windows regression test covering a write root that inherits
`FILE_DELETE_CHILD`, verifying that repeated refresh checks leave its explicit
write ACE unchanged.

GitOrigin-RevId: d0df9429efcf299da3ff3c1bce92942684803293

2026-07-20 18:28:02 +00:00