Dylan Hurd 52e387daca Prevent protected-path rename bypasses in macOS Seatbelt (#39623) ...

## Why

Renaming a writable directory could move protected descendants outside the
paths covered by their read-only or unreadable policy entries.

## What changed

- Deny unlink-style writes to directory ancestors of protected paths, placing
  these rules after broader write allowances in the generated Seatbelt policy.
- Apply full write denies to unreadable glob matches and protect their directory
  ancestors against renames.
- Support brace alternation and backslash escapes when translating filesystem
  globs into Seatbelt regular expressions.

## Testing

Add coverage for ancestor rename attempts across explicit read-only and deny
entries, multiple glob forms, canonicalized glob paths, and the new glob syntax.

GitOrigin-RevId: edfda9d4c2bc7ba2ecd6b67744446871e526084f

2026-08-20 06:47:30 +00:00

..

src

Prevent protected-path rename bypasses in macOS Seatbelt (#39623)

2026-08-20 06:47:30 +00:00

BUILD.bazel

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

Cargo.toml

Support Windows sandboxing in the exec server (#34423)

2026-07-20 22:35:14 +00:00