jif f6950546e5 Protect macOS Seatbelt writable root anchors (#39599) ...

## Why

A sandboxed process could replace a writable directory root, changing the
authority boundary used to construct a later sandbox policy.

## What changed

- Deny unlinking or renaming directory roots granted write access by Seatbelt,
  while preserving replacement and deletion behavior for writable files.
- Reject writable roots with nested symlink components and report these as
  Seatbelt preparation errors instead of network proxy failures.
- Normalize writable roots before adding them to the generated Seatbelt policy.

## Testing

Add coverage for symlink rejection, error classification, directory-root
replacement and rename protection, newly created roots, and writable file
replacement.

GitOrigin-RevId: ab1ed4e55f20034bc43e028e6529d3d1f0d8181c

2026-08-20 05:36:23 +00:00

..

src

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

BUILD.bazel

Protect macOS Seatbelt writable root anchors (#39599)

2026-08-20 05:36:23 +00:00

Cargo.toml

Support Windows sandboxing in the exec server (#34423)

2026-07-20 22:35:14 +00:00