github/codex
4
0 Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-13 14:46:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Skip missing paths in filesystem sandbox entries (#34598)

Browse Source 
## Why

Default read-only protections for project metadata should apply when paths such
as `.git`, `.agents`, and `.codex` exist, without causing sandbox setup to
materialize missing paths as ACL targets.

## What changed

- Add an optional `missing_path_behavior` to filesystem sandbox entries and
  mark default project-metadata protections with `skip`.
- Preserve the behavior through permission transforms and exec/MCP protocol
  serialization while keeping existing path wire variants stable.
- Ignore skip-missing entries when projecting configuration or Windows sandbox
  overrides, while retaining explicit metadata carveouts.

## Testing

- Cover protocol round trips for path and special-path entries.
- Verify default metadata protections and Windows explicit carveout handling.

GitOrigin-RevId: 6df13dadacdd131c44aab9f15a967c81051355c1
This commit is contained in:
iceweasel-oai authored and copyberry committed 2026-07-21 19:17:18 +00:00
1 parent ee71c4a90f
commit 87f71e35b8
63 files changed
+825 -132
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

codex-rs/protocol/src/permissions.rs
+208 -100
View File
@@ -174,6 +174,37 @@ impl FileSystemSpecialPath {
pub struct FileSystemSandboxEntry {
pub path: FileSystemPath,
pub access: FileSystemAccessMode,
#[serde(default, skip_serializing_if = "Option::is_none")]
#[ts(optional)]
pub missing_path_behavior: Option<FileSystemSandboxEntryMissingPathBehavior>,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema, TS)]
#[serde(rename_all = "snake_case")]
pub enum FileSystemSandboxEntryMissingPathBehavior {
Skip,
}
impl FileSystemSandboxEntry {
pub fn new(path: FileSystemPath, access: FileSystemAccessMode) -> Self {
Self {
path,
access,
missing_path_behavior: None,
}
}
pub fn skip_missing_path(path: FileSystemPath, access: FileSystemAccessMode) -> Self {
Self {
path,
access,
missing_path_behavior: Some(FileSystemSandboxEntryMissingPathBehavior::Skip),
}
}
pub fn skips_missing_path(&self) -> bool {
self.missing_path_behavior == Some(FileSystemSandboxEntryMissingPathBehavior::Skip)
}
}
#[derive(
@@ -355,12 +386,12 @@ pub fn project_roots_glob_pattern(subpath: &Path) -> String {
}
fn read_only_file_system_entries() -> Vec<FileSystemSandboxEntry> {
vec![FileSystemSandboxEntry {
path: FileSystemPath::Special {
vec![FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
}]
FileSystemAccessMode::Read,
)]
}
impl Default for FileSystemSandboxPolicy {
@@ -398,6 +429,26 @@ impl FileSystemSandboxPolicy {
}
}
/// Removes entries that should be skipped when their paths are missing.
///
/// Callers that materialize filesystem ACL targets should not turn these
/// entries into newly-created sentinel paths.
pub fn remove_skip_missing_path_entries(&mut self) {
self.entries.retain(|entry| !entry.skips_missing_path());
}
pub fn has_explicit_non_write_entry_for_path_with_cwd(&self, path: &Path, cwd: &Path) -> bool {
let Some(path) = resolve_candidate_path(path, cwd) else {
return false;
};
let cwd = AbsolutePathBuf::from_absolute_path(cwd).ok();
self.entries.iter().any(|entry| {
!entry.skips_missing_path()
&& !entry.access.can_write()
&& resolve_entry_path(&entry.path, cwd.as_ref()).as_ref() == Some(&path)
})
}
fn has_root_access(&self, predicate: impl Fn(FileSystemAccessMode) -> bool) -> bool {
matches!(self.kind, FileSystemSandboxKind::Restricted)
&& self.entries.iter().any(|entry| {
@@ -449,12 +500,12 @@ impl FileSystemSandboxPolicy {
.iter()
.any(|entry| entry.access == FileSystemAccessMode::Deny);
if matches!(self.kind, FileSystemSandboxKind::Unrestricted) && has_deny_read_entries {
*self = Self::restricted(vec![FileSystemSandboxEntry {
path: FileSystemPath::Special {
*self = Self::restricted(vec![FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Write,
}]);
FileSystemAccessMode::Write,
)]);
}
if !matches!(self.kind, FileSystemSandboxKind::Restricted) {
@@ -521,44 +572,38 @@ impl FileSystemSandboxPolicy {
exclude_tmpdir_env_var: bool,
exclude_slash_tmp: bool,
) -> Self {
let mut entries = vec![FileSystemSandboxEntry {
path: FileSystemPath::Special {
let mut entries = vec![FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
}];
FileSystemAccessMode::Read,
)];
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special {
entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
});
FileSystemAccessMode::Write,
));
if !exclude_slash_tmp {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special {
entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::SlashTmp,
},
access: FileSystemAccessMode::Write,
});
FileSystemAccessMode::Write,
));
}
if !exclude_tmpdir_env_var {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special {
entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Tmpdir,
},
access: FileSystemAccessMode::Write,
});
FileSystemAccessMode::Write,
));
}
entries.extend(
writable_roots
.iter()
.cloned()
.map(|path| FileSystemSandboxEntry {
path: FileSystemPath::Path { path },
access: FileSystemAccessMode::Write,
}),
);
entries.extend(writable_roots.iter().cloned().map(|path| {
FileSystemSandboxEntry::new(FileSystemPath::Path { path }, FileSystemAccessMode::Write)
}));
append_default_read_only_project_root_subpath_if_no_explicit_rule(&mut entries, ".git");
append_default_read_only_project_root_subpath_if_no_explicit_rule(&mut entries, ".agents");
@@ -758,6 +803,7 @@ impl FileSystemSandboxPolicy {
},
},
access: entry.access,
missing_path_behavior: entry.missing_path_behavior,
}));
}
FileSystemPath::GlobPattern { pattern } => {
@@ -767,11 +813,13 @@ impl FileSystemSandboxPolicy {
pattern: resolve_project_roots_glob_pattern(subpath, root),
},
access: entry.access,
missing_path_behavior: entry.missing_path_behavior,
}));
} else {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::GlobPattern { pattern },
access: entry.access,
missing_path_behavior: entry.missing_path_behavior,
});
}
}
@@ -779,12 +827,14 @@ impl FileSystemSandboxPolicy {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Path { path },
access: entry.access,
missing_path_behavior: entry.missing_path_behavior,
});
}
FileSystemPath::Special { value } => {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special { value },
access: entry.access,
missing_path_behavior: entry.missing_path_behavior,
});
}
}
@@ -824,10 +874,10 @@ impl FileSystemSandboxPolicy {
continue;
}
self.entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Path { path: path.clone() },
access: FileSystemAccessMode::Read,
});
self.entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Path { path: path.clone() },
FileSystemAccessMode::Read,
));
}
self
@@ -843,10 +893,10 @@ impl FileSystemSandboxPolicy {
continue;
}
self.entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Path { path: path.clone() },
access: FileSystemAccessMode::Write,
});
self.entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Path { path: path.clone() },
FileSystemAccessMode::Write,
));
}
self
@@ -871,10 +921,10 @@ impl FileSystemSandboxPolicy {
entry.access.can_write()
&& matches!(&entry.path, FileSystemPath::Path { path: existing } if existing == path)
}) {
self.entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Path { path: path.clone() },
access: FileSystemAccessMode::Write,
});
self.entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Path { path: path.clone() },
FileSystemAccessMode::Write,
));
}
for protected_path in default_read_only_subpaths_for_writable_root(
@@ -1258,12 +1308,12 @@ impl From<&SandboxPolicy> for FileSystemSandboxPolicy {
SandboxPolicy::DangerFullAccess => FileSystemSandboxPolicy::unrestricted(),
SandboxPolicy::ExternalSandbox { .. } => FileSystemSandboxPolicy::external_sandbox(),
SandboxPolicy::ReadOnly { .. } => {
FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
}])
FileSystemAccessMode::Read,
)])
}
SandboxPolicy::WorkspaceWrite {
writable_roots,
@@ -1600,45 +1650,39 @@ fn legacy_runtime_file_system_policy_for_cwd(
};
let mut entries = vec![
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemAccessMode::Read,
),
FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
},
FileSystemAccessMode::Write,
),
];
if !*exclude_slash_tmp {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special {
entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::SlashTmp,
},
access: FileSystemAccessMode::Write,
});
FileSystemAccessMode::Write,
));
}
if !*exclude_tmpdir_env_var {
entries.push(FileSystemSandboxEntry {
path: FileSystemPath::Special {
entries.push(FileSystemSandboxEntry::new(
FileSystemPath::Special {
value: FileSystemSpecialPath::Tmpdir,
},
access: FileSystemAccessMode::Write,
});
FileSystemAccessMode::Write,
));
}
entries.extend(
writable_roots
.iter()
.cloned()
.map(|path| FileSystemSandboxEntry {
path: FileSystemPath::Path { path },
access: FileSystemAccessMode::Write,
}),
);
entries.extend(writable_roots.iter().cloned().map(|path| {
FileSystemSandboxEntry::new(FileSystemPath::Path { path }, FileSystemAccessMode::Write)
}));
if let Ok(cwd_root) = AbsolutePathBuf::from_absolute_path(cwd) {
for protected_path in default_read_only_subpaths_for_writable_root(
@@ -1689,10 +1733,10 @@ fn append_default_read_only_entry_if_no_explicit_rule(
return;
}
entries.push(FileSystemSandboxEntry {
entries.push(FileSystemSandboxEntry::skip_missing_path(
path,
access: FileSystemAccessMode::Read,
});
FileSystemAccessMode::Read,
));
}
fn has_explicit_resolved_path_entry(
@@ -1887,6 +1931,7 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
@@ -1896,6 +1941,7 @@ mod tests {
),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
]);
@@ -1928,6 +1974,7 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
let writable_roots = policy.get_writable_roots_with_cwd(cwd.path());
@@ -1957,31 +2004,33 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(Some(".git".into())),
},
access: FileSystemAccessMode::Read,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemAccessMode::Read,
),
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(Some(".agents".into())),
},
access: FileSystemAccessMode::Read,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemAccessMode::Read,
),
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(Some(".codex".into())),
},
access: FileSystemAccessMode::Read,
},
FileSystemAccessMode::Read,
),
])
);
}
@@ -2023,12 +2072,14 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: explicit_dot_codex.clone(),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
]);
@@ -2068,6 +2119,7 @@ mod tests {
FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
path: FileSystemPath::Path { path: root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
assert!(!file_system_policy.can_write_path_with_cwd(&dot_git_config, cwd.path()));
@@ -2114,21 +2166,23 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
];
expected_entries.extend(PROTECTED_METADATA_PATH_NAMES.iter().map(|name| {
FileSystemSandboxEntry {
path: FileSystemPath::Special {
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(Some((*name).into())),
},
access: FileSystemAccessMode::Read,
}
FileSystemAccessMode::Read,
)
}));
expected_entries.extend(
default_read_only_subpaths_for_writable_root(
@@ -2136,9 +2190,11 @@ mod tests {
/*protect_missing_dot_codex*/ true,
)
.into_iter()
.map(|path| FileSystemSandboxEntry {
path: FileSystemPath::Path { path },
access: FileSystemAccessMode::Read,
.map(|path| {
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Path { path },
FileSystemAccessMode::Read,
)
}),
);
@@ -2190,10 +2246,12 @@ mod tests {
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_blocked },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2246,16 +2304,19 @@ mod tests {
value: FileSystemSpecialPath::Minimal,
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_blocked },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2313,6 +2374,7 @@ mod tests {
let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
path: FileSystemPath::Path { path: root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
let writable_roots = policy.get_writable_roots_with_cwd(cwd.path());
@@ -2353,10 +2415,12 @@ mod tests {
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_private },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2400,10 +2464,12 @@ mod tests {
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_private },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2442,10 +2508,12 @@ mod tests {
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: root },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: alias },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2502,10 +2570,12 @@ mod tests {
value: FileSystemSpecialPath::Tmpdir,
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: link_blocked },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2542,22 +2612,26 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs.clone() },
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: docs_private.clone(),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: docs_private_public.clone(),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
]);
@@ -2589,10 +2663,12 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs },
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
]);
@@ -2675,10 +2751,12 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs.clone() },
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
]);
@@ -2713,10 +2791,12 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs.clone() },
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
]);
@@ -2743,12 +2823,14 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2769,14 +2851,17 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs.clone() },
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: docs.clone() },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
]);
@@ -2796,6 +2881,7 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
}]);
let actual = policy
@@ -2814,6 +2900,7 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
let actual = policy
@@ -2834,6 +2921,7 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
let actual = policy.with_additional_writable_roots(&cwd, std::slice::from_ref(&extra));
@@ -2846,10 +2934,12 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path { path: extra },
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
])
);
@@ -2868,18 +2958,21 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Special {
value: FileSystemSpecialPath::project_roots(Some(".git".into())),
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::GlobPattern {
pattern: project_roots_glob_pattern(Path::new("**/*.env")),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
]);
@@ -2894,24 +2987,28 @@ mod tests {
path: first.clone(),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: second.clone(),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: first.join(".git"),
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: second.join(".git"),
},
access: FileSystemAccessMode::Read,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::GlobPattern {
@@ -2923,6 +3020,7 @@ mod tests {
.into_owned(),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::GlobPattern {
@@ -2934,6 +3032,7 @@ mod tests {
.into_owned(),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
},
])
);
@@ -2947,6 +3046,7 @@ mod tests {
pattern: project_roots_glob_pattern(Path::new("**/*.env")),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
}]);
let actual = policy.materialize_project_roots_with_cwd(cwd.path());
@@ -2960,6 +3060,7 @@ mod tests {
.into_owned(),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
}])
);
}
@@ -2975,6 +3076,7 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
}]);
let actual =
@@ -2988,19 +3090,21 @@ mod tests {
value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: extra.clone()
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
FileSystemSandboxEntry {
path: FileSystemPath::Path {
FileSystemSandboxEntry::skip_missing_path(
FileSystemPath::Path {
path: extra.join(".git")
},
access: FileSystemAccessMode::Read,
},
FileSystemAccessMode::Read,
),
])
);
}
@@ -3019,6 +3123,7 @@ mod tests {
path: denied.clone(),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
}]);
let rebuilt = FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
@@ -3054,6 +3159,7 @@ mod tests {
value: FileSystemSpecialPath::Root,
},
access: FileSystemAccessMode::Write,
missing_path_behavior: None,
},
deny_entry,
]);
@@ -3067,6 +3173,7 @@ mod tests {
path: AbsolutePathBuf::try_from(path).expect("absolute deny path"),
},
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
}])
}
@@ -3074,6 +3181,7 @@ mod tests {
FileSystemSandboxEntry {
path: FileSystemPath::GlobPattern { pattern },
access: FileSystemAccessMode::Deny,
missing_path_behavior: None,
}
}