viyatb-oai f194d4b115 fix: reopen writable linux carveouts under denied parents (#14514) ...

## Summary
- preserve Linux bubblewrap semantics for `write -> none -> write`
filesystem policies by recreating masked mount targets before rebinding
narrower writable descendants
- add a Linux runtime regression for `/repo = write`, `/repo/a = none`,
`/repo/a/b = write` so the nested writable child is exercised under
bubblewrap
- document the supported legacy Landlock fallback and the split-policy
bubblewrap behavior for overlapping carveouts

## Example
Given a split filesystem policy like:

```toml
"/repo" = "write"
"/repo/a" = "none"
"/repo/a/b" = "write"
```

this PR keeps `/repo` writable, masks `/repo/a`, and still reopens
`/repo/a/b` as writable again under bubblewrap.

## Testing
- `just fmt`
- `cargo test -p codex-linux-sandbox`
- `cargo clippy -p codex-linux-sandbox --tests -- -D warnings`

f194d4b115 · 2026-03-13 01:36:06 +00:00

History

..

suite

fix: reopen writable linux carveouts under denied parents (#14514)

2026-03-13 01:36:06 +00:00

all.rs

test: faster test execution in codex-core (#2633)

2025-08-24 11:10:53 -07:00