Nick Steele 7cec3e110c Mask daemon socket paths exposed through ancestor bind mounts (#47079) ...

## Why

The Linux sandbox rejected bind mounts of ancestors of the app-server socket directory, even when the exposed socket paths could be masked. This prevented sandbox startup with otherwise usable temporary-directory mount layouts.

## What changed

- Collect the socket directory and its exposed ancestor-mount aliases, then mask each path after filesystem binds, including read-only subpaths and the synthetic-mount registry.
- Continue rejecting direct directory or socket aliases and nested mounts that cannot preserve socket isolation.
- Reject non-UTF-8 mask destinations to avoid masking a different path through lossy conversion.

## Testing

Extend mount-analysis tests for ancestor aliases, private temporary directories, and WSLg masks. Extend socket-isolation coverage to verify that ancestor and registry aliases hide daemon sockets while unrelated sockets remain reachable. Add a regression test for non-UTF-8 mask paths.

GitOrigin-RevId: 49a9a764fbe1fddacd99c3a78099fbffff53b944

2026-09-21 18:04:14 +00:00

..

suite

Mask daemon socket paths exposed through ancestor bind mounts (#47079)

2026-09-21 18:04:14 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00