Eric Traut 632420e67a Drop capabilities from Linux sandbox processes (#39103) ...

## What changed

- Pass `--cap-drop ALL` in both bubblewrap launch modes.
- Verify in the inner sandbox stage that the effective and permitted Linux
  capability sets are empty, and abort before executing the command otherwise.
- Cover the generated bubblewrap arguments, capability state of sandboxed
  commands, and rejection of a capability-bearing inner-stage process.

GitOrigin-RevId: 9dbd651d306d92327e36c9b3f308619db7d80a67

2026-08-17 23:21:28 +00:00

..

suite

Drop capabilities from Linux sandbox processes (#39103)

2026-08-17 23:21:28 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00