aabe0f259c
Today, there is a single capability SID that allows the sandbox to write to * workspace (cwd) * tmp directories if enabled * additional writable roots This change splits those up, so that each workspace has its own capability SID, while tmp and additional roots, which are installation-wide, are still governed by the "generic" capability SID This isolates workspaces from each other in terms of sandbox write access. Also allows us to protect <cwd>/.codex when codex runs in a specific <cwd> |
||
|---|---|---|
| .. | ||
| src | ||
| BUILD.bazel | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| codex-windows-sandbox-setup.manifest | ||
| sandbox_smoketests.py | ||