Eric Traut fb0781b9ee Harden bubblewrap synthetic mount registry isolation (#40302) ...

## Why

The synthetic mount registry must remain private to the sandbox helper. A
writable bind overlapping its temporary directory could expose the registry,
and a pre-existing registry symlink could redirect bookkeeping into a writable
location.

## What changed

- Add the registry's read-only bind while constructing filesystem mounts, but
  only when a writable bind exposes it and before applying deny masks.
- Reject a symlinked registry path before registering mounts or starting the
  sandboxed command.

## Testing

Add coverage for symlink rejection and for denied temporary directories under
both full-root and minimal filesystem policies.

GitOrigin-RevId: 3adff28998f0ef8c8ec26a73e5a1183b4931c0e8

2026-08-24 00:52:52 +00:00

..

suite

Harden bubblewrap synthetic mount registry isolation (#40302)

2026-08-24 00:52:52 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00