viyatb-oai 7aa8f51049 Reject sandbox-writable bubblewrap executables from PATH (#51211) ...

## Why

Bubblewrap discovery probes executables before confinement. Excluding only the command's current directory leaves candidates in other writable roots eligible to run outside the sandbox.

## What changed

- Filter canonical `PATH` candidates using the filesystem policy and effective user permissions, including writable ancestors, symlinked roots, and full-disk write access. Preserve protected system installations while rejecting replaceable paths.
- Select the launcher with the command's permissions before the proc-mount preflight, retaining the bundled bubblewrap fallback.
- Use the effective permission profile and policy working directory for startup warning probes.

## Testing

Add unit coverage for writable roots, symlinks, read-only carveouts, replaceable parents, and full-disk policies. Add Linux integration tests showing writable `bwrap` candidates are neither probed nor launched, including when the command runs in a workspace subdirectory or uses managed networking with full-disk write access.

GitOrigin-RevId: 188c9f45e727eaace062f5abb1205dc23fdf3c51

2026-10-06 00:58:19 +00:00

..

suite

Reject sandbox-writable bubblewrap executables from PATH (#51211)

2026-10-06 00:58:19 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00