pash-openai 22dea11020 Allow unrelated namespace mounts in Linux sandbox socket checks (#46535) ...

## Why

Namespace mounts can have roots such as `mnt:[inode]` or `net:[inode]` that are not filesystem paths. Treating every mount root as a path rejects these unrelated mounts and prevents sandbox startup.

## What changed

Parse mount roots as paths only for the daemon socket's filesystem. Continue validating every mount destination and checking mount ancestry, nested mounts, and socket aliases.

## Testing

Add regression cases for namespace mounts, invalid destinations, and socket aliases, both with and without a mount ID. Extend the socket-isolation integration fixture with an unrelated network namespace mount to exercise successful startup and rejection of a real socket alias.

GitOrigin-RevId: 9a1d2a69e5bd3f8d09b1de7cf998ee6d9c6bb980

2026-09-19 00:31:23 +00:00

..

bazel_bwrap.rs

…

bundled_bwrap.rs

…

bwrap_wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

bwrap.rs

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00

daemon_mounts_tests.rs

Allow unrelated namespace mounts in Linux sandbox socket checks (#46535)

2026-09-19 00:31:23 +00:00

daemon_mounts.rs

Allow unrelated namespace mounts in Linux sandbox socket checks (#46535)

2026-09-19 00:31:23 +00:00

exec_util.rs

…

fd_mount_tests.rs

…

fd_mount.rs

…

landlock.rs

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

launcher.rs

…

lib.rs

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00

linux_run_main_tests.rs

Fix daemon socket isolation checks for private tmp mounts (#46125)

2026-09-17 05:23:55 +00:00

linux_run_main.rs

Fix daemon socket isolation checks for private tmp mounts (#46125)

2026-09-17 05:23:55 +00:00

main.rs

…

proxy_lifecycle_tests.rs

…

proxy_lifecycle.rs

…

proxy_routing.rs

…

wslg_tests.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00

wslg.rs

Hide WSLg's duplicate root in restricted Linux sandboxes (#45837)

2026-09-16 02:17:36 +00:00