iceweasel-oai d117c2eb02 Expand MXC volume grants and resolve deny globs (#44289) ...

## Why

MXC volume-root grants are nonrecursive, and filesystem deny globs were rejected before launch.

## What changed

- Expand volume-root grants to include existing immediate children, preserving read-only carveouts and denies. Children created directly under a volume root after policy construction are not granted access.
- Normalize filesystem object aliases before and after expansion so generated grants preserve tighter access restrictions.
- Skip unavailable volumes and uninspectable generated children.
- Resolve deny globs into concrete file and directory paths using the Windows sandbox resolver.

## Testing

Add regression tests for read-only children and aliases, normalized root access, uninspectable children, and deny glob expansion alongside explicit denies.

GitOrigin-RevId: 3242e9a30d16581d6fe5b7b6e39e0e0f71ca6ef4

2026-09-09 20:02:40 +00:00

..

src

Expand MXC volume grants and resolve deny globs (#44289)

2026-09-09 20:02:40 +00:00

BUILD.bazel

Add a native Windows MXC sandbox adapter (#42841)

2026-09-04 20:09:04 +00:00

Cargo.toml

Expand MXC volume grants and resolve deny globs (#44289)

2026-09-09 20:02:40 +00:00