Sean Huang cc05ecfe17 Resolve filesystem denials with explicit path context (#44669) ...

## Why

Filesystem denial paths need to use the owning environment's path syntax, base directory, and home directory. Host-native resolution cannot supply those facts for another platform, and invalid denials must not be silently skipped when building the sandbox policy.

## What changed

- Add `ConfigPathContext` to requirements layers so `permissions.filesystem.deny_read` can resolve using explicit POSIX or Windows path facts, with native defaults when no context is supplied.
- Share URI-based resolution and validation for literal paths and glob prefixes. Reject ambiguous or lossy paths, including NUL bytes, Windows stream syntax, and unsupported UNC spellings.
- Move denial conversion into `FilesystemConstraints::apply_to_policy`, preserving glob patterns and deduplicating entries. Validate all denials before modifying the policy and propagate failures through configuration loading.

## Testing

Add tests for per-layer base and home resolution, Windows drives and globs, nested context restoration, missing home directories, and policy conversion without partial mutation. Add a configuration-loading regression test for a required denial glob containing a NUL byte.

GitOrigin-RevId: fa0da0d149407958e39897a39fe7b87edd6f1644

2026-09-10 23:08:23 +00:00

..

src

Resolve filesystem denials with explicit path context (#44669)

2026-09-10 23:08:23 +00:00

BUILD.bazel

…

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00