Eric Traut fb0781b9ee
Harden bubblewrap synthetic mount registry isolation ( #40302 ) ...
## Why
The synthetic mount registry must remain private to the sandbox helper. A
writable bind overlapping its temporary directory could expose the registry,
and a pre-existing registry symlink could redirect bookkeeping into a writable
location.
## What changed
- Add the registry's read-only bind while constructing filesystem mounts, but
only when a writable bind exposes it and before applying deny masks.
- Reject a symlinked registry path before registering mounts or starting the
sandboxed command.
## Testing
Add coverage for symlink rejection and for denied temporary directories under
both full-root and minimal filesystem policies.
GitOrigin-RevId: 3adff28998f0ef8c8ec26a73e5a1183b4931c0e8
2026-08-24 00:52:52 +00:00
2026-08-23 10:06:57 +00:00
2026-08-23 03:25:56 +00:00
2026-08-18 23:05:52 +00:00
2026-08-23 10:06:57 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-20 08:10:08 +00:00
2026-08-20 08:10:08 +00:00
2026-08-21 20:57:17 +00:00
2026-08-20 19:28:32 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-21 19:11:05 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 19:35:22 +00:00
2026-08-21 14:14:00 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-21 16:50:34 +00:00
2026-08-21 06:41:28 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 23:13:37 +00:00
2026-08-22 05:54:43 +00:00
2026-08-04 22:58:02 +00:00
2026-08-21 21:41:55 +00:00
2026-08-07 00:23:38 +00:00
2026-08-23 18:53:15 +00:00
2026-08-23 23:56:23 +00:00
2026-08-22 00:42:19 +00:00
2026-08-21 21:28:16 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-23 00:27:02 +00:00
2026-08-21 17:21:30 +00:00
2026-08-21 17:21:30 +00:00
2026-08-17 04:37:50 +00:00
2026-08-23 17:02:21 +00:00
2026-08-20 08:24:18 +00:00
2026-08-23 21:29:11 +00:00
2026-08-18 21:46:18 +00:00
2026-07-31 21:37:56 +00:00
2026-08-20 17:16:52 +00:00
2026-08-20 08:10:08 +00:00
2026-08-18 12:37:41 +00:00
2026-08-21 21:45:26 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-08-24 00:52:52 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 17:46:05 +00:00
2026-08-23 04:59:28 +00:00
2026-08-21 20:57:17 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 18:29:35 +00:00
2026-08-21 17:29:41 +00:00
2026-08-20 19:09:04 +00:00
2026-08-21 21:01:59 +00:00
2026-08-23 23:38:12 +00:00
2026-08-23 17:02:21 +00:00
2026-08-15 01:34:33 +00:00
2026-08-21 16:45:05 +00:00
2026-08-22 05:54:43 +00:00
2026-08-18 23:05:52 +00:00
2026-08-06 03:11:42 +00:00
2026-08-21 17:16:51 +00:00
2026-08-10 15:43:10 +00:00
2026-08-20 17:39:06 +00:00
2026-08-08 16:58:26 +00:00
2026-08-20 06:10:03 +00:00
2026-08-20 05:16:59 +00:00
2026-08-04 03:49:53 +00:00
2026-08-20 18:29:35 +00:00
2026-08-20 21:50:51 +00:00
2026-08-20 19:09:04 +00:00
2026-08-24 00:48:31 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 14:55:08 +00:00
2026-08-21 16:56:42 +00:00
2026-08-15 14:31:04 +00:00
2026-08-21 22:24:28 +00:00
2026-08-21 19:04:32 +00:00
2026-08-18 22:00:25 +00:00
Eric Traut
fb0781b9ee