sayan-oai ad9e8097fd
Preserve managed deny-read rules across permission updates ( #40004 ) ...
## Why
Runtime permission updates must not weaken managed filesystem `deny_read`
requirements.
## What changed
- Retain managed deny-read rules separately and merge them into updated
permission profiles.
- Reject permission profiles and legacy sandbox policies that conflict with a
managed denied path.
- Apply the same constraint when `command/exec` handles a request-specific
sandbox policy.
## Testing
- Cover thread permission updates with managed deny-read requirements.
- Cover `command/exec` enforcement for managed and user-defined denies,
including conflicting policy and profile overrides.
GitOrigin-RevId: 5e387b9c1bf1650a21753a74a3338bd33df7d0ce
2026-08-21 20:15:23 +00:00
2026-07-23 19:19:35 +00:00
2026-08-20 20:44:31 +00:00
2026-07-29 13:53:15 +00:00
2026-08-21 20:15:23 +00:00
2026-08-18 23:05:52 +00:00
2026-08-21 19:56:52 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-20 08:10:08 +00:00
2026-08-20 08:10:08 +00:00
2026-05-08 04:07:59 +00:00
2026-08-20 19:28:32 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-21 19:11:05 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 19:35:22 +00:00
2026-08-21 14:14:00 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-21 16:50:34 +00:00
2026-08-21 06:41:28 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 23:13:37 +00:00
2026-08-21 17:21:30 +00:00
2026-08-21 19:20:09 +00:00
2026-08-21 20:15:23 +00:00
2026-08-20 07:11:46 +00:00
2026-08-20 17:16:52 +00:00
2026-08-13 00:00:16 +00:00
2026-08-20 08:28:35 +00:00
2026-08-21 17:21:30 +00:00
2026-08-21 17:21:30 +00:00
2026-08-17 04:37:50 +00:00
2026-08-21 19:11:05 +00:00
2026-08-20 08:24:18 +00:00
2026-08-21 19:11:05 +00:00
2026-08-18 21:46:18 +00:00
2026-07-31 21:37:56 +00:00
2026-08-20 17:16:52 +00:00
2026-08-20 08:10:08 +00:00
2026-08-18 12:37:41 +00:00
2026-08-18 23:23:23 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-08-20 06:57:00 +00:00
2026-07-22 04:17:34 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 17:46:05 +00:00
2026-08-20 19:19:41 +00:00
2026-07-17 20:52:42 +00:00
2026-08-21 19:04:32 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 18:29:35 +00:00
2026-08-21 17:29:41 +00:00
2026-07-30 04:26:36 +00:00
2026-08-20 19:09:04 +00:00
2026-08-10 14:25:13 +00:00
2026-05-25 17:26:10 -03:00
2026-08-20 07:03:02 +00:00
2026-08-21 19:11:05 +00:00
2026-08-15 01:34:33 +00:00
2026-08-21 16:45:05 +00:00
2026-08-21 13:28:28 +00:00
2026-08-18 23:05:52 +00:00
2026-08-06 03:11:42 +00:00
2026-08-21 17:16:51 +00:00
2026-08-10 15:43:10 +00:00
2026-08-20 17:39:06 +00:00
2026-08-08 16:58:26 +00:00
2026-08-20 06:10:03 +00:00
2026-08-20 05:16:59 +00:00
2026-05-07 15:44:17 -07:00
2026-08-04 03:49:53 +00:00
2026-08-20 18:29:35 +00:00
2026-08-20 21:50:51 +00:00
2026-08-20 19:09:04 +00:00
2026-08-21 19:47:49 +00:00
2026-05-07 15:44:17 -07:00
2026-08-21 19:04:32 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-08-20 14:55:08 +00:00
2026-08-21 16:56:42 +00:00
2026-08-15 14:31:04 +00:00
2026-08-21 19:04:32 +00:00
2026-08-21 19:04:32 +00:00
2026-07-11 03:27:51 +00:00
2026-08-18 22:00:25 +00:00
2026-05-26 20:59:47 -07:00
2025-05-07 08:37:48 -07:00
ad9e8097fd