mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
chess
2833985d88
## Why A runtime directory can have read/execute access while existing files and subdirectories lack inherited permissions. Checking only the runtime roots leaves those children inaccessible to sandbox users. ## What changed - Walk the Codex app runtime tree and add missing read/execute grants for the sandbox group, validating access after changes. - Use `GRANT_ACCESS` to preserve existing grants and skip additions that could override deny entries, including inherited denials for other trustees. - Skip reparse points and trees with reparse-point ancestors, tolerate disappearing paths, and report repair failures through setup logging and refresh errors. ## Testing Add Windows regression tests for repairing children beneath an already-readable root, repeated repairs, preserving read/write denials and other trustees' inherited file denials, avoiding write or ACL-management grants, and leaving junction targets untouched. GitOrigin-RevId: 93d55dd9fca2b24eac157ae9be505982d07dd9b9