viyatb-oai f194d4b115 fix: reopen writable linux carveouts under denied parents (#14514) ... ## Summary - preserve Linux bubblewrap semantics for `write -> none -> write` filesystem policies by recreating masked mount targets before rebinding narrower writable descendants - add a Linux runtime regression for `/repo = write`, `/repo/a = none`, `/repo/a/b = write` so the nested writable child is exercised under bubblewrap - document the supported legacy Landlock fallback and the split-policy bubblewrap behavior for overlapping carveouts ## Example Given a split filesystem policy like: ```toml "/repo" = "write" "/repo/a" = "none" "/repo/a/b" = "write" ``` this PR keeps `/repo` writable, masks `/repo/a`, and still reopens `/repo/a/b` as writable again under bubblewrap. ## Testing - `just fmt` - `cargo test -p codex-linux-sandbox` - `cargo clippy -p codex-linux-sandbox --tests -- -D warnings`		2026-03-13 01:36:06 +00:00
..
suite	fix: reopen writable linux carveouts under denied parents (#14514)	2026-03-13 01:36:06 +00:00
all.rs	test: faster test execution in codex-core (#2633)	2025-08-24 11:10:53 -07:00