viyatb-oai d92aae5501 Centralize filesystem permission resolution for sandbox enforcement (#59009) ...

## What changed

- Add `resolve_for_enforcement` to collect filesystem grants, denials, glob patterns, and platform defaults with backend-specific path handling.
- Use the shared result in Linux bubblewrap and macOS Seatbelt policy generation, including Seatbelt scratch access and filesystem policy equivalence checks.
- Pass already-derived filesystem and network policies to Linux seccomp setup instead of converting the permission profile again.

## Testing

Extend the Seatbelt glob test to execute sandboxed commands and verify that relative deny patterns through a symlink block reads and writes while sibling files remain editable.

GitOrigin-RevId: 748603f6b5a6db739b198a0f93a899041612370a

2026-11-02 23:19:47 +00:00

..

src

Centralize filesystem permission resolution for sandbox enforcement (#59009)

2026-11-02 23:19:47 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00