johnl-oai dd12f892f1 Avoid sharing violations when repairing Windows runtime ACLs (#51822) ...

## Why

Opening active EXE/DLL files with `MAXIMUM_ALLOWED` can request access that causes sharing violations during sandbox runtime ACL repair.

## What changed

Restrict `MAXIMUM_ALLOWED` opens to directories that need to suppress child ACL propagation. For files, request `READ_CONTROL | WRITE_DAC` only when an ACL update is needed.

Preserve the non-inheriting grant behavior from https://github.com/openai/codex/pull/49690, including existing permissions, deny ACEs, and null DACLs.

## Testing

Extend the Windows runtime repair regression test to hold `node.exe` open with `FILE_SHARE_READ` throughout repair and revalidation, while checking read/execute access and preserved denials.

GitOrigin-RevId: 2e087b51adc0221d0eda061fa0a34d2e98409662

2026-10-07 20:46:56 +00:00

..

src

Avoid sharing violations when repairing Windows runtime ACLs (#51822)

2026-10-07 20:46:56 +00:00

tests

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

BUILD.bazel

Serialize tests that share Windows sandbox accounts (#49389)

2026-09-29 22:50:07 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00