viyatb-oai f194d4b115 fix: reopen writable linux carveouts under denied parents (#14514) ...

## Summary
- preserve Linux bubblewrap semantics for `write -> none -> write`
filesystem policies by recreating masked mount targets before rebinding
narrower writable descendants
- add a Linux runtime regression for `/repo = write`, `/repo/a = none`,
`/repo/a/b = write` so the nested writable child is exercised under
bubblewrap
- document the supported legacy Landlock fallback and the split-policy
bubblewrap behavior for overlapping carveouts

## Example
Given a split filesystem policy like:

```toml
"/repo" = "write"
"/repo/a" = "none"
"/repo/a/b" = "write"
```

this PR keeps `/repo` writable, masks `/repo/a`, and still reopens
`/repo/a/b` as writable again under bubblewrap.

## Testing
- `just fmt`
- `cargo test -p codex-linux-sandbox`
- `cargo clippy -p codex-linux-sandbox --tests -- -D warnings`

2026-03-13 01:36:06 +00:00

..

landlock.rs

fix: reopen writable linux carveouts under denied parents (#14514)

2026-03-13 01:36:06 +00:00

managed_proxy.rs

refactor: make bubblewrap the default Linux sandbox (#13996)

2026-03-11 23:31:18 -07:00

mod.rs

…