iceweasel-oai 74af2496c9 Default local binding to true for MXC managed networking (#46523) ...

## Why

MXC's native host-loopback access is bidirectional, so it cannot enforce `allow_local_binding = false`. Treating an omitted setting as `false` prevents managed networking from working with the default configuration.

## What changed

- Preserve an omitted `allow_local_binding` until the executor's sandbox policy is known. Default to `true` for Windows MXC and `false` elsewhere, including remote execution.
- Reject an effective `false` for MXC managed networking after applying policy restrictions, without enabling disabled networking.
- Use the executor's resolved value for remote network approval decisions while preserving explicit controller restrictions.
- Document that local binding permits local servers and direct host-loopback connections and skips additional private-network destination checks; proxy domain rules still apply.

## Testing

Add coverage for per-executor defaults, explicit values, MXC rejection of `false`, and remote network review cleanup with the resolved policy.

GitOrigin-RevId: 0fa7c1eaec68bebada2b8f7af45688315eea70a9

2026-09-19 00:00:01 +00:00

..

src

Default local binding to true for MXC managed networking (#46523)

2026-09-19 00:00:01 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Support configured credential providers across shell snapshots (#44072)

2026-09-09 06:04:59 +00:00