sayan-oai ad9e8097fd Preserve managed deny-read rules across permission updates (#40004) ...

## Why

Runtime permission updates must not weaken managed filesystem `deny_read`
requirements.

## What changed

- Retain managed deny-read rules separately and merge them into updated
  permission profiles.
- Reject permission profiles and legacy sandbox policies that conflict with a
  managed denied path.
- Apply the same constraint when `command/exec` handles a request-specific
  sandbox policy.

## Testing

- Cover thread permission updates with managed deny-read requirements.
- Cover `command/exec` enforcement for managed and user-defined denies,
  including conflicting policy and profile overrides.

GitOrigin-RevId: 5e387b9c1bf1650a21753a74a3338bd33df7d0ce

2026-08-21 20:15:23 +00:00

49 KiB

Raw Blame History

View Raw