iceweasel-oai f59905647a Protect Windows sandbox binaries from inherited write access (#42330) ...

## Why

An inherited write ACE from a writable parent directory could leave sandbox
runner files in `.sandbox-bin` writable or deletable by the workspace capability
SID.

## What changed

- Mark the `.sandbox-bin` DACL as protected when applying its explicit ACL, while
  preserving inherited DACL behavior for the other persistent sandbox
  directories.
- Cover both full and provision-only setup, including runner files created before
  and after the directory is locked.

GitOrigin-RevId: fcda4df97e3f8d729438ccb3d42daa606076e0c4

2026-09-02 19:03:32 +00:00

..

src

Protect Windows sandbox binaries from inherited write access (#42330)

2026-09-02 19:03:32 +00:00

tests

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

BUILD.bazel

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00