Yuzhu Shen ae7aad586e Fix Linux sandbox startup with multiple denied files (#50059) ...

## Why

Bubblewrap consumes and closes the file descriptor for each `--ro-bind-data` mount. Reusing one descriptor across multiple file masks prevents the sandbox from starting.

## What changed

Open and preserve a separate `/dev/null` descriptor for each empty-file mask.

## Testing

Extend unit tests to verify distinct descriptors for multiple denied files and missing-path masks. Add integration coverage for exact-path and glob deny rules, checking that the sandbox starts, denied files remain unreadable and unwritable, and allowed files remain accessible.

GitOrigin-RevId: 85158c83699afd36bb7aca453b2652d777cf65e4

2026-10-01 18:05:33 +00:00

..

suite

Fix Linux sandbox startup with multiple denied files (#50059)

2026-10-01 18:05:33 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00