Remove generated-default filesystem path variants (#33632)

## What changed

- Represent built-in filesystem policy entries with the same `Path` and
  `Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
  simplify elevated deny-write handling to rely on direct-runtime enforcement
  and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
  the reduced filesystem path model.

GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c
This commit is contained in:
pakrym-oai authored and copyberry committed 2026-07-16 16:13:53 +00:00
1 parent 21c37fb374
commit 5a85351dfe
11 files changed
+61 -341

No files matched your search

+1 -21
View File
@@ -126,10 +126,8 @@ pub struct WalkOutcome {
#[serde(tag = "type", rename_all = "snake_case")]
pub enum ExecFileSystemPath {
Path { path: PathUri },
GeneratedDefaultPath { path: PathUri },
GlobPattern { pattern: String },
Special { value: FileSystemSpecialPath },
GeneratedDefaultSpecial { value: FileSystemSpecialPath },
}
impl From<FileSystemPath> for ExecFileSystemPath {
@@ -138,14 +136,8 @@ impl From<FileSystemPath> for ExecFileSystemPath {
FileSystemPath::Path { path } => Self::Path {
path: PathUri::from_abs_path(&path),
},
FileSystemPath::GeneratedDefaultPath { path } => Self::GeneratedDefaultPath {
path: PathUri::from_abs_path(&path),
},
FileSystemPath::GlobPattern { pattern } => Self::GlobPattern { pattern },
FileSystemPath::Special { value } => Self::Special { value },
FileSystemPath::GeneratedDefaultSpecial { value } => {
Self::GeneratedDefaultSpecial { value }
}
}
}
}
@@ -158,14 +150,8 @@ impl TryFrom<ExecFileSystemPath> for FileSystemPath {
ExecFileSystemPath::Path { path } => Self::Path {
path: path.to_abs_path()?,
},
ExecFileSystemPath::GeneratedDefaultPath { path } => Self::GeneratedDefaultPath {
path: path.to_abs_path()?,
},
ExecFileSystemPath::GlobPattern { pattern } => Self::GlobPattern { pattern },
ExecFileSystemPath::Special { value } => Self::Special { value },
ExecFileSystemPath::GeneratedDefaultSpecial { value } => {
Self::GeneratedDefaultSpecial { value }
}
})
}
}
@@ -364,14 +350,8 @@ impl FileSystemSandboxContext {
ExecFileSystemPath::GlobPattern { pattern } => !Path::new(pattern).is_absolute(),
ExecFileSystemPath::Special {
value: FileSystemSpecialPath::ProjectRoots { .. },
}
| ExecFileSystemPath::GeneratedDefaultSpecial {
value: FileSystemSpecialPath::ProjectRoots { .. },
} => true,
ExecFileSystemPath::Path { .. }
| ExecFileSystemPath::GeneratedDefaultPath { .. }
| ExecFileSystemPath::Special { .. }
| ExecFileSystemPath::GeneratedDefaultSpecial { .. } => false,
ExecFileSystemPath::Path { .. } | ExecFileSystemPath::Special { .. } => false,
}),
ExecPermissionProfile::Managed {
file_system: ExecManagedFileSystemPermissions::Unrestricted,