iceweasel-oai 5c013177d8 Support temporary and minimal filesystem grants in MXC (#44620) ...

## Why

MXC rejected symbolic temporary-directory and minimal filesystem entries, preventing policies using them from reaching execution.

## What changed

- Resolve `Tmpdir` entries from absolute `TEMP` and `TMP` paths in the filtered command environment, matching variable names case-insensitively.
- Ignore `SlashTmp` entries because `/tmp` has no special meaning on the Windows executor.
- Include platform read roots when the policy requests platform defaults, preserving explicit denies.

## Testing

Add coverage for temporary paths and invalid environment values, optional platform roots, explicit denies, empty commands, and Windows case-insensitive read/write overrides.

GitOrigin-RevId: feb69157ff35bcf648fa0ed0e7d4376818bc1941

2026-09-10 18:57:16 +00:00

..

src

Support temporary and minimal filesystem grants in MXC (#44620)

2026-09-10 18:57:16 +00:00

BUILD.bazel

Add a native Windows MXC sandbox adapter (#42841)

2026-09-04 20:09:04 +00:00

Cargo.toml

Expand MXC volume grants and resolve deny globs (#44289)

2026-09-09 20:02:40 +00:00