iceweasel-oai d1696652a2 Support symbolic :root filesystem policies in MXC (#44580) ...

## Why

MXC rejected filesystem policies containing `:root` or granting full disk write access, preventing these policies from being translated into native grants.

## What changed

- Resolve `:root` against every executor volume before applying permission precedence and read-only carveouts.
- Grant full disk write access across enumerated volumes while preserving explicit writable paths outside them, such as unmapped shares.
- Treat a `:root` deny as the default so narrower explicit grants survive, while retaining explicit path denies.
- Continue rejecting unsupported symbolic paths with a more specific error.

## Testing

Add regression tests for precedence across drives and working directories, volume grant expansion, explicit grants outside enumerated volumes, root denies with narrower grants, and restrictions on one volume preserving grants on another.

GitOrigin-RevId: 94c9fec9e6429913714ebbdeca382c4f1624b5a2

2026-09-10 16:42:34 +00:00

..

src

Support symbolic :root filesystem policies in MXC (#44580)

2026-09-10 16:42:34 +00:00

BUILD.bazel

Add a native Windows MXC sandbox adapter (#42841)

2026-09-04 20:09:04 +00:00

Cargo.toml

Expand MXC volume grants and resolve deny globs (#44289)

2026-09-09 20:02:40 +00:00