Ian MacLeod f71543813f Block WSL interop escapes from restricted filesystem sandboxes (#44286) ...

## Why

With network access enabled, WSL interop can launch Windows processes outside the Linux filesystem sandbox, including using `wsl.exe` to reenter the distribution as root.

## What changed

- Mask WSL interop sockets in bubblewrap when filesystem write access is restricted, and hide inherited procfs when running without a fresh proc mount.
- Deny `AF_VSOCK` sockets and `io_uring` under restricted filesystem policies even when ordinary network access is allowed, closing the VM socket route to host services.
- Reject legacy Landlock configurations that combine restricted filesystem access with unrestricted networking when the WSL interop directory exists.

## Testing

Add unit coverage for mount masking and legacy policy rejection, plus WSL integration tests for Windows process launch, bind aliases, direct `/init` invocation, root reentry, and `--no-proc` isolation. WSL tests skip when host prerequisites are unavailable.

GitOrigin-RevId: 1e8b97ac43675807ee541ca614534d9b1febf410

2026-09-09 19:43:41 +00:00

..

suite

Block WSL interop escapes from restricted filesystem sandboxes (#44286)

2026-09-09 19:43:41 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00