Eric Traut 8ece31a7bf Hide WSLg's duplicate root in restricted Linux sandboxes (#45837) ...

## Why

WSLg's duplicate distro root can expose filesystem contents outside the sandbox's path masks.

## What changed

- Detect the duplicate root using filesystem identity, with mount metadata as a fallback, and hide it after applying filesystem grants and denials.
- Reject explicit grants, working directories, and executable paths that use the WSLg alias, directing users to the primary filesystem paths.
- Hide host procfs when a fresh procfs cannot be mounted so process roots cannot restore access to the masked view.

## Testing

Add regression tests for duplicate-root detection, mask ordering, existing ancestor masks, alias rejection, and unrestricted filesystem behavior. Add a WSLg runtime test covering masking with and without fresh procfs, continued access to an allowed file, and rejection of an executable using the alias.

GitOrigin-RevId: 9ea31724c00fb24e3a504b6658339e8dfea35343

2026-09-16 02:17:36 +00:00

..

suite

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00