viyatb-oai 7aa8f51049 Reject sandbox-writable bubblewrap executables from PATH (#51211) ...

## Why

Bubblewrap discovery probes executables before confinement. Excluding only the command's current directory leaves candidates in other writable roots eligible to run outside the sandbox.

## What changed

- Filter canonical `PATH` candidates using the filesystem policy and effective user permissions, including writable ancestors, symlinked roots, and full-disk write access. Preserve protected system installations while rejecting replaceable paths.
- Select the launcher with the command's permissions before the proc-mount preflight, retaining the bundled bubblewrap fallback.
- Use the effective permission profile and policy working directory for startup warning probes.

## Testing

Add unit coverage for writable roots, symlinks, read-only carveouts, replaceable parents, and full-disk policies. Add Linux integration tests showing writable `bwrap` candidates are neither probed nor launched, including when the command runs in a workspace subdirectory or uses managed networking with full-disk write access.

GitOrigin-RevId: 188c9f45e727eaace062f5abb1205dc23fdf3c51

2026-10-06 00:58:19 +00:00

..

common

Centralize executable fixture creation to avoid Linux ETXTBSY races (#48727)

2026-09-27 15:25:13 +00:00

exec_process

Reject sandbox-writable bubblewrap executables from PATH (#51211)

2026-10-06 00:58:19 +00:00

file_system

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00

relay

Retry registry authentication outages and jitter executor reconnects (#50465)

2026-10-02 23:54:32 +00:00

support

Move relay helpers into exec-server test support (#40712)

2026-08-25 21:31:40 +00:00

unit

Recover deferred environments after provisioning failure (#42388)

2026-09-02 23:49:29 +00:00

accepted_websocket.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

capability_discovery.rs

Share byte buffers across exec-server output chunks (#49972)

2026-10-01 12:41:39 +00:00

chatgpt_cloudflare_affinity.rs

Add opt-in concurrent exec-server request dispatch (#36987)

2026-08-04 22:28:15 +00:00

deferred_environment.rs

Expose the last accepted environment ready report (#42403)

2026-09-03 01:12:36 +00:00

environment_config.rs

Add portable project trust lookup APIs (#47620)

2026-09-23 18:40:12 +00:00

environment.rs

Honor network policy in remote control and recover remote execution (#47410)

2026-09-23 00:48:53 +00:00

exec_process.rs

Reject sandbox-writable bubblewrap executables from PATH (#51211)

2026-10-06 00:58:19 +00:00

file_stream.rs

Enable writable file streaming in exec-server (#50177)

2026-10-02 04:25:52 +00:00

file_system_unix.rs

Preserve filesystem sandbox policy context when the cwd disappears (#46112)

2026-09-17 04:37:54 +00:00

file_system_windows.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

forward.rs

Share byte buffers across exec-server output chunks (#49972)

2026-10-01 12:41:39 +00:00

health.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

http_client.rs

Cache executor metadata from initialization (#40343)

2026-08-24 06:43:07 +00:00

http_request_logging.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_request.rs

Protect the guardian decisions API key from environment forwarding (#50019)

2026-10-01 15:57:53 +00:00

initialize.rs

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00

macos_fs_spawn.rs

Avoid fork when spawning macOS filesystem helpers (#46661)

2026-09-19 15:15:25 +00:00

process.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

relay.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

selected_capability_roots.rs

Initialize execution environments with the final HTTP policy (#34995)

2026-07-23 19:24:41 +00:00

websocket.rs

[codex] Trace exec-server JSON-RPC requests (#27466)

2026-06-24 12:50:18 -07:00