iceweasel-oai a4f37a5b7f Harden Windows sandbox provisioning against reparse points (#39083) ...

## Why

Elevated provisioning can apply ACLs beneath a user-supplied `CODEX_HOME`.
Following a directory junction or another reparse point could apply those ACLs
to a different directory than the one provisioning intended to secure.

## What changed

- Require provisioning paths to be absolute paths on a local Windows disk.
- In provision-only mode, open or create sandbox directories with
  `OBJ_DONT_REPARSE` and keep the resulting handle open while applying ACLs
  with `SetSecurityInfo`.
- Reject reparse points in both the final directory and its ancestors while
  preserving the existing path-based behavior for full setup.

## Testing

Add Windows tests covering plain directory creation and rejection of junctions
at both the leaf and ancestor levels.

GitOrigin-RevId: d165b8b3685c89bc171e4d58c63c739fa9fb2cf9

2026-08-17 21:10:58 +00:00

..

src

Harden Windows sandbox provisioning against reparse points (#39083)

2026-08-17 21:10:58 +00:00

tests

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

BUILD.bazel

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

chore(cli) deprecate --full-auto (#20133)

2026-04-29 04:41:30 +00:00