viyatb-oai 44481a1c45 Limit the Linux /proc preflight filesystem view (#34409) ...

## What changed

- Run the bubblewrap `/proc` mount probe with the minimal read-only filesystem policy instead of the command's filesystem policy and working directory.
- Preserve the requested network namespace mode during the probe.
- Add coverage that the probe mounts a temporary root and `/proc` without binding the full filesystem.

GitOrigin-RevId: e3bc4352f510980aeebe81dedf3f9211947982ed

2026-07-20 20:50:02 +00:00

..

bazel_bwrap.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

bundled_bwrap.rs

runtime: use install context for bundled bwrap (#23634)

2026-05-20 08:24:43 -07:00

bwrap.rs

Preserve special filesystem subpaths as wire strings (#33107)

2026-07-14 16:40:13 +00:00

exec_util.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

landlock.rs

[codex] Allow socketpair in proxy-routed Linux sandbox (#26625)

2026-06-05 09:34:36 -07:00

launcher.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

lib.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

linux_run_main_tests.rs

Limit the Linux /proc preflight filesystem view (#34409)

2026-07-20 20:50:02 +00:00

linux_run_main.rs

Limit the Linux /proc preflight filesystem view (#34409)

2026-07-20 20:50:02 +00:00

main.rs

fix: overhaul how we spawn commands under seccomp/landlock on Linux (#1086)

2025-05-23 11:37:07 -07:00

proxy_routing.rs

fix: attribut network requests to the exact exec on linux (#29697)

2026-07-06 14:51:34 -07:00