viyatb-oai 5667598c8d Use resolved filesystem permissions in Windows sandbox policies (#59233) ...

## What changed

Use `resolve_for_enforcement` when preparing Windows restricted-token and elevated sandbox overrides, preserving read-only carveouts at volume roots. Expand deny-read ACL targets from the resolved permissions.

Use the same resolution in MXC policy preparation when volume roots do not require materialization, while retaining special handling for symbolic root denies.

## Testing

Add regression coverage for read-only carveouts in a volume-root workspace. Extend the Windows package smoke test to verify that a helper-created log matching a deny glob cannot be read while a neighboring allowed file remains readable.

GitOrigin-RevId: cee0834444464b3a7b0c8dbeecb8abcd5828b4b0

2026-11-03 21:23:50 +00:00

..

bin

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

conpty

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

elevated

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

helper_materialization

Refactor Windows sandbox setup and service helpers (#45455)

2026-09-14 16:05:40 +00:00

provisioning_client

Resume Windows sandbox registration refresh after service restarts (#45559)

2026-09-15 00:42:31 +00:00

setup_provisioning

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

unified_exec

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

uninstall_windows

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

wfp

…

acl_tests.rs

Preserve PowerShell relative paths in the elevated Windows sandbox (#49690)

2026-09-30 17:50:58 +00:00

acl.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

allow.rs

Protect .aws directories under sandbox writable roots (#48176)

2026-09-25 19:14:31 +00:00

app_package_tests.rs

Clarify registered Windows sandbox setup errors (#47673)

2026-09-23 21:43:01 +00:00

app_package.rs

Clarify registered Windows sandbox setup errors (#47673)

2026-09-23 21:43:01 +00:00

cap.rs

…

deny_read_acl.rs

Register Windows desktop uninstall ownership before sandbox setup (#45224)

2026-09-13 13:06:40 +00:00

deny_read_resolver_access_tests.rs

Always use private desktops for legacy Windows sandboxes (#46554)

2026-09-19 01:21:32 +00:00

deny_read_resolver.rs

Use resolved filesystem permissions in Windows sandbox policies (#59233)

2026-11-03 21:23:50 +00:00

deny_read_state_tests.rs

Recover malformed Windows deny-read ACL state safely (#50940)

2026-10-04 19:07:36 +00:00

deny_read_state.rs

Recover malformed Windows deny-read ACL state safely (#50940)

2026-10-04 19:07:36 +00:00

deny_read_walker_tests.rs

Improve sandboxing, MCP errors, and cached approvals (#41196)

2026-08-27 20:05:08 +00:00

deny_read_walker.rs

Use resolved filesystem permissions in Windows sandbox policies (#59233)

2026-11-03 21:23:50 +00:00

desktop_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

desktop.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

dpapi.rs

…

elevated_impl.rs

Always use private desktops for legacy Windows sandboxes (#46554)

2026-09-19 01:21:32 +00:00

env.rs

…

environment_transport_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

environment_transport.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

file_write_tests.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

file_write.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

framed_io.rs

Add an authenticated Windows sandbox provisioning client (#42337)

2026-09-02 19:33:34 +00:00

helper_materialization.rs

Add opt-in registered package execution to the Windows sandbox (#45550)

2026-09-14 23:55:04 +00:00

hide_users.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

identity_integration_tests.rs

Repair rejected Windows sandbox credentials during provisioning (#47695)

2026-09-23 23:33:19 +00:00

identity.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

installation_record.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

launch_environment_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

launch_environment.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

lib.rs

Use resolved filesystem permissions in Windows sandbox policies (#59233)

2026-11-03 21:23:50 +00:00

logging.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

no_reparse_dir_tests.rs

Fix no-reparse directory opens on Windows 10 (#47672)

2026-09-23 21:35:22 +00:00

no_reparse_dir.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

package_identity.rs

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

path_normalization.rs

…

proc_thread_attr.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

process.rs

Align Windows sandbox temp permissions with the child environment (#51512)

2026-10-06 23:21:06 +00:00

provisioning_client_tests.rs

Prefer the provisioning service for automatic Windows sandbox setup (#46239)

2026-09-17 15:35:39 +00:00

provisioning_client.rs

Start the Windows sandbox service during registered Core setup (#51256)

2026-10-06 03:43:22 +00:00

provisioning_protocol.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

resolved_permissions.rs

Align Windows sandbox temp permissions with the child environment (#51512)

2026-10-06 23:21:06 +00:00

runtime_ownership_tests.rs

Handle disabled Windows sandbox accounts during cleanup (#46333)

2026-09-18 00:36:07 +00:00

runtime_ownership.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

sandbox_utils.rs

Allow nested Git repositories in the Windows sandbox (#38080)

2026-08-11 22:22:18 +00:00

service_diagnostics.rs

Record Windows sandbox service stop diagnostics (#50507)

2026-10-03 03:20:37 +00:00

service_identity_tests.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

service_identity.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

setup_acl_error_tests.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

setup_acl_error.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

setup_error.rs

…

setup_launch_tests.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

setup_launch.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup_mutex.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup_provisioning.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

setup_refresh_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup.rs

Add a CLI command to uninstall the legacy Windows sandbox (#50437)

2026-10-02 21:51:46 +00:00

spawn_prep.rs

Keep Windows sandbox private desktops alive across helper exits (#44658)

2026-09-10 22:17:03 +00:00

ssh_config_dependencies.rs

…

stdio_bridge_tests.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

stdio_bridge.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

token_groups_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_user_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_user.rs

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

token.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

uninstall_windows.rs

Add a CLI command to uninstall the legacy Windows sandbox (#50437)

2026-10-02 21:51:46 +00:00

wfp_setup.rs

Support managed OpenTelemetry metadata and PEM client identities (#57658)

2026-10-28 06:24:24 +00:00

wfp.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

winutil.rs

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

workspace_acl.rs

…

wrapper_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

wrapper.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00