iceweasel-oai 11da6b9edc Add policy-based file contents integrity checks (#51828) ...

## What changed

Export `FileContentsChecker` and structured integrity findings from `codex-rs/sandboxing` to identify existing containment dependency files whose contents are writable under a prepared filesystem policy. Findings include the requested target, its resolved path, and the write roots that permit modification.

Resolve symlinks in targets, write roots, and read-only carveouts, and respect protected metadata paths and deny globs matching resolved contents. Missing targets produce no finding; non-file targets return an error. Callers remain responsible for dependency inventory, reporting, enforcement, and handling full-disk write access.

## Testing

Add unit tests covering write grants, read-only and denied carveouts, overlapping grants, deny globs, symlink resolution, protected metadata, and missing targets.

GitOrigin-RevId: 4f52faed822a1bbb4ed33a9975af0718a5f85662

2026-10-07 20:54:13 +00:00

..

src

Add policy-based file contents integrity checks (#51828)

2026-10-07 20:54:13 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00