Eric Traut 8ece31a7bf Hide WSLg's duplicate root in restricted Linux sandboxes (#45837) ...

## Why

WSLg's duplicate distro root can expose filesystem contents outside the sandbox's path masks.

## What changed

- Detect the duplicate root using filesystem identity, with mount metadata as a fallback, and hide it after applying filesystem grants and denials.
- Reject explicit grants, working directories, and executable paths that use the WSLg alias, directing users to the primary filesystem paths.
- Hide host procfs when a fresh procfs cannot be mounted so process roots cannot restore access to the masked view.

## Testing

Add regression tests for duplicate-root detection, mask ordering, existing ancestor masks, alias rejection, and unrestricted filesystem behavior. Add a WSLg runtime test covering masking with and without fresh procfs, continued access to an allowed file, and rejection of an executable using the alias.

GitOrigin-RevId: 9ea31724c00fb24e3a504b6658339e8dfea35343

2026-09-16 02:17:36 +00:00

..

bundled_bwrap.rs

Verify bundled bwrap in Bazel builds (#38494)

2026-08-14 05:03:39 +00:00

landlock.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

managed_proxy_unix_sockets_tests.rs

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

managed_proxy.rs

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

mod.rs

Verify bundled bwrap in Bazel builds (#38494)

2026-08-14 05:03:39 +00:00

wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00