viyatb-oai d92aae5501
Centralize filesystem permission resolution for sandbox enforcement ( #59009 ) ...
## What changed
- Add `resolve_for_enforcement` to collect filesystem grants, denials, glob patterns, and platform defaults with backend-specific path handling.
- Use the shared result in Linux bubblewrap and macOS Seatbelt policy generation, including Seatbelt scratch access and filesystem policy equivalence checks.
- Pass already-derived filesystem and network policies to Linux seccomp setup instead of converting the permission profile again.
## Testing
Extend the Seatbelt glob test to execute sandboxed commands and verify that relative deny patterns through a symlink block reads and writes while sibling files remain editable.
GitOrigin-RevId: 748603f6b5a6db739b198a0f93a899041612370a
2026-11-02 23:19:47 +00:00
2026-10-30 18:02:30 +00:00
2026-10-14 07:13:22 +00:00
2026-10-29 17:25:51 +00:00
2026-10-27 05:52:01 +00:00
2026-10-23 14:59:40 +00:00
2026-11-02 20:57:23 +00:00
2026-11-02 19:44:42 +00:00
2026-10-29 11:23:51 +00:00
2026-10-27 18:35:19 +00:00
2026-11-02 16:00:20 +00:00
2026-11-02 16:00:20 +00:00
2026-10-26 20:02:45 +00:00
2026-11-02 17:05:56 +00:00
2026-10-26 20:26:32 +00:00
2026-10-27 22:59:22 +00:00
2026-10-22 19:36:47 +00:00
2026-10-27 17:04:16 +00:00
2026-10-26 21:08:15 +00:00
2026-11-02 18:31:19 +00:00
2026-10-26 18:06:07 +00:00
2026-10-30 02:28:51 +00:00
2026-10-20 15:43:19 +00:00
2026-10-29 16:57:12 +00:00
2026-10-29 16:57:12 +00:00
2026-10-29 01:04:48 +00:00
2026-10-29 01:04:48 +00:00
2026-11-02 21:37:17 +00:00
2026-10-19 21:43:19 +00:00
2026-11-02 17:55:39 +00:00
2026-11-02 23:19:03 +00:00
2026-10-30 20:39:47 +00:00
2026-10-29 18:24:34 +00:00
2026-11-02 23:19:03 +00:00
2026-11-02 19:25:02 +00:00
2026-10-19 15:15:17 +00:00
2026-11-02 19:39:23 +00:00
2026-10-27 05:52:01 +00:00
2026-10-26 19:19:10 +00:00
2026-11-02 20:36:39 +00:00
2026-11-02 21:09:09 +00:00
2026-10-30 14:56:08 +00:00
2026-10-27 23:53:09 +00:00
2026-10-30 18:20:57 +00:00
2026-11-02 23:07:21 +00:00
2026-10-28 21:22:06 +00:00
2026-11-02 21:47:45 +00:00
2026-10-22 19:36:47 +00:00
2026-10-22 19:36:47 +00:00
2026-10-27 23:53:09 +00:00
2026-10-13 17:22:34 +00:00
2026-10-26 20:40:53 +00:00
2026-11-02 23:07:21 +00:00
2026-10-30 20:53:25 +00:00
2026-10-26 19:21:08 +00:00
2026-11-01 15:50:50 +00:00
2026-10-22 19:36:47 +00:00
2026-11-02 23:19:47 +00:00
2026-10-30 16:16:57 +00:00
2026-10-30 15:11:02 +00:00
2026-10-22 19:36:47 +00:00
2026-11-02 19:26:15 +00:00
2026-11-02 20:34:35 +00:00
2026-10-22 19:36:47 +00:00
2026-11-02 17:35:57 +00:00
2026-11-02 08:31:14 +00:00
2026-11-02 14:06:17 +00:00
2026-10-29 20:17:58 +00:00
2026-10-26 18:22:40 +00:00
2026-11-02 20:57:23 +00:00
2026-10-27 16:36:32 +00:00
2026-11-02 14:06:17 +00:00
2026-11-02 23:19:47 +00:00
2026-10-30 21:01:23 +00:00
2026-10-19 16:56:42 +00:00
2026-11-01 15:50:50 +00:00
2026-11-02 19:44:42 +00:00
2026-10-30 14:40:32 +00:00
2026-10-28 00:51:29 +00:00
2026-11-02 23:19:47 +00:00
2026-10-27 05:52:01 +00:00
2026-10-22 04:59:19 +00:00
2026-10-27 05:52:01 +00:00
2026-10-29 17:49:51 +00:00
2026-11-02 16:00:20 +00:00
2026-10-22 00:19:02 +00:00
2026-10-30 07:11:56 +00:00
2026-11-02 19:25:02 +00:00
2026-11-02 19:45:06 +00:00
2026-10-30 20:53:25 +00:00
2026-11-02 23:19:03 +00:00
2026-10-13 22:40:57 +00:00
2026-10-30 20:53:25 +00:00
2026-10-30 16:35:54 +00:00
2026-10-27 05:52:01 +00:00
2026-10-27 05:52:01 +00:00
2026-10-28 11:48:00 +00:00
2026-10-28 06:24:24 +00:00
2026-10-29 22:36:06 +00:00
2026-10-28 21:09:05 +00:00
2026-11-02 21:22:16 +00:00
2026-11-02 19:26:15 +00:00
2026-10-30 23:56:12 +00:00
2026-10-27 05:52:01 +00:00
viyatb-oai
d92aae5501