feat(bwrap): add filesystem preflight diagnostics by MGudgin · Pull Request #1160 · microsoft/mxc

Gudge (MGudgin) · 2026-09-14T21:58:20Z

This PR adds actionable Bubblewrap diagnostics for paths hidden by the deny-by-
default filesystem baseline. Launch-time cwd preflight rejects only paths that
are provably uncovered or denied and defers ambiguous namespace cases to
Bubblewrap with retained warnings.

Fixes #507

Details

Distinguish uncovered, denied, and inconclusive cwd diagnostics while keeping
host-dependent checks out of the stable validate surface.
Model synthetic /dev, /proc, and /var/run -> /run topology, including
policy mounts that shadow the compatibility link.
Preserve caller deniedPaths spellings through symlink, hard-link, and
filesystem-object alias normalization without probing unchanged spellings.
Preserve lxc-exec failure output in shell E2Es and accurately identify
resolver-config inspection failures.
Add unit, parser-corpus, documentation, and real Bubblewrap E2E coverage.

Tests

cargo fmt --all -- --check
cargo check -p bwrap_common --target x86_64-unknown-linux-gnu
cargo clippy -p bwrap_common --target x86_64-unknown-linux-gnu -- -D warnings
cargo test -p bwrap_common in WSL (379 passed)
Exact wxc_common differential repository corpus test
node scripts/versioning/validate-configs.js (373 configs, 11 exempt)
Rebuilt lxc-exec, basic Bubblewrap E2E, and cwd-preflight E2E

azure-pipelines · 2026-09-14T21:58:29Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

🟡 Changes recommended

Cwd validation mishandles symlinks and synthetic parents created by denied mounts.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 1

Open findings (1)

Resolve symlinked cwd targets before declaring them visible · New

What changed in this PR

Adds Bubblewrap filesystem preflight diagnostics to replace opaque launch-time failures.

Changes:

Validates process.cwd visibility before launch.
Warns about hidden resolver symlink targets.
Adds unit tests and backend documentation.

File	Description
`bwrap_runner.rs`	Implements diagnostics and tests.
`bwrap_command.rs`	Exposes baseline mount paths for validation.
`bubblewrap-backend.md`	Documents preflight behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Host-path canonicalization can disagree with Bubblewrap’s assembled namespace, causing false rejections and incorrect warning suppression.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 1

Open (1)

Resolve cwd using the assembled namespace topology · New

Resolved since last review (1)

Resolve symlinked cwd targets before declaring them visible

Copilot

Copilot review overview

🔵 Needs a closer look

Parent-component and symlinked mount-destination handling can produce incorrect preflight verdicts.

Review tier: Balanced
Findings: 1

Open (1)

Resolve cwd using the assembled namespace topology

Copilot

Copilot review overview

🟡 Changes recommended

Synthetic parents created by denied mounts are incorrectly rejected, and denied-cwd remediation is misleading.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 1

Open (1)

Make the denied-cwd remediation actionable · New

Resolved since last review (1)

Resolve cwd using the assembled namespace topology

Copilot

Copilot review overview

🟡 Changes recommended

Denied-path diagnostics can identify internal rewritten paths and recommend remediation that cannot resolve the denial.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 2

Open (2)

Do not label a rewritten mask as the configured entry · New
Use denied-path remediation for resolver targets · New

Resolved since last review (1)

Make the denied-cwd remediation actionable

Copilot

Copilot review overview

🔵 Needs a closer look

Some denied-path diagnostics identify internal paths or recommend remediation that cannot resolve the policy conflict.

Review tier: Balanced
Findings: 2

Open (2)

Use denied-path remediation for resolver targets
Do not label a rewritten mask as the configured entry

Copilot

Copilot review overview

🟡 Changes recommended

The preflight omits the synthetic /var/run mapping and can reject a CWD that is visible in the assembled namespace.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Model the synthetic /var/run compatibility link · New

Copilot

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 2 · 1

Open (3)

With set -e semantics (likely enabled earlier in this script, consistent with other test… · New
This script uses set -euo pipefail, but several expected-success invocations capture output via… · New
The warning says \"could not inspect symlinked\" even when the failure is simply that the path… · New

Resolved since last review (1)

Model the synthetic /var/run compatibility link

Copilot

Copilot review overview

🟡 Changes recommended

Policy mounts shadowing /var/run and normalized filesystem aliases can currently produce incorrect diagnostics.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 4 · 1

Open (5)

Do not label normalized aliases as caller denied entries · New
Account for policy mounts that shadow /var/run · New
This script uses set -euo pipefail, but several expected-success invocations capture output via…
With set -e semantics (likely enabled earlier in this script, consistent with other test…
The warning says \"could not inspect symlinked\" even when the failure is simply that the path…

Copilot

Copilot review overview

🟢 Approval recommended

The implementation is fail-safe, documented, and thoroughly covered across unit and end-to-end tests.

Review effort: Balanced
Findings: 2

Open (2)

Account for policy mounts that shadow /var/run
Do not label normalized aliases as caller denied entries

Resolved since last review (3)

This script uses set -euo pipefail, but several expected-success invocations capture output via…
With set -e semantics (likely enabled earlier in this script, consistent with other test…
The warning says \"could not inspect symlinked\" even when the failure is simply that the path…

Copilot

Copilot review overview

🟡 Changes recommended

Denied-path provenance performs quadratic filesystem metadata probes for ordinary policies.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Avoid quadratic filesystem probes for denied-path provenance · New

Resolved since last review (2)

Account for policy mounts that shadow /var/run
Do not label normalized aliases as caller denied entries

Copilot

Copilot review overview

🟢 Approval recommended

The implementation is consistent with the assembled namespace model and includes thorough regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Avoid quadratic filesystem probes for denied-path provenance

This PR adds actionable Bubblewrap diagnostics for paths hidden by the deny-by- default filesystem baseline. Launch-time cwd preflight rejects only paths that are provably uncovered or denied and defers ambiguous namespace cases to Bubblewrap with retained warnings. Details * Distinguish uncovered, denied, and inconclusive cwd diagnostics while keeping host-dependent checks out of the stable validate surface. * Model synthetic `/dev`, `/proc`, and `/var/run -> /run` topology, including policy mounts that shadow the compatibility link. * Preserve caller `deniedPaths` spellings through symlink, hard-link, and filesystem-object alias normalization without probing unchanged spellings. * Preserve `lxc-exec` failure output in shell E2Es and accurately identify resolver-config inspection failures. * Add unit, configuration, documentation, and real Bubblewrap E2E coverage. Tests * `cargo fmt --all -- --check` * `cargo check -p bwrap_common --target x86_64-unknown-linux-gnu` * `cargo clippy -p bwrap_common --target x86_64-unknown-linux-gnu -- -D warnings` * `cargo test -p bwrap_common -- --test-threads=1` in WSL (394 passed) * `cargo test -p wxc_common -- config_deserialize` in WSL (25 passed) * `node scripts/versioning/validate-configs.js` (405 configs, 15 exempt) * Rebuilt `lxc-exec`, basic Bubblewrap E2E, and cwd-preflight E2E Fixes #507 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7bde2bdd-d3ba-468d-8ecb-4174e134507e Generated-with: gpt-5.6-sol

Copilot

Copilot review overview

🟡 Changes recommended

Resolver diagnostics miss policies hiding /etc/resolv.conf itself, and the new relative-cwd documentation contradicts schema 0.9 behavior.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 3

Open (4)

Account for policy mounts hiding resolv_conf · New
Document schema version split for relative start_directory · New
Version-qualify relative cwd normalization behavior · New
Make start_directory contract version-aware · New

+    match working_directory_visibility(request, &target) {
+        PathVisibility::Visible => {}


+  `filesystem.readwritePaths`. Symlinked paths and paths containing `..` are
+  advisory: the runner records that it cannot decide conclusively and leaves
+  Bubblewrap as the authority, avoiding false rejection of a valid namespace
+  path. Relative values remain passed through to `bwrap` unchanged.


+reject a valid namespace path. Relative values retain the general verbatim
+behavior described above.


+        // Preserve the backend's existing contract: relative cwd values are
+        // passed verbatim to `bwrap --chdir`. Without a stable sandbox base
+        // directory, rejecting them here would add behavior beyond #507.


Gudge (MGudgin) · 2026-09-24T20:07:03Z

Closing this PR because the implementation is not converging.

The original goal in #507 remains valid, but this approach has expanded into a second model of Bubblewrap namespace and path-resolution semantics. Repeated review rounds continue to uncover additional correctness gaps across mount precedence, symlinks, policy aliases, resolver visibility, and version-specific cwd behavior. Continuing to patch this branch would increase risk without establishing a stable design boundary.

#507 remains open. A replacement should start with a smaller design: separate the resolver diagnostic from cwd handling, and make any cwd preflight advisory-only or derive it from a shared structured mount plan consumed by both argument generation and diagnostics.

The branch is retained for reference.

Copilot AI balanced review requested due to automatic review settings September 14, 2026 21:58

Gudge (MGudgin) requested a review from a team as a code owner September 14, 2026 21:58

Copilot started reviewing on behalf of Gudge (MGudgin) September 14, 2026 21:58 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Soham Das (SohamDas2021) reviewed Sep 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 15, 2026 15:28

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from 9aceabd to a0c379a Compare September 15, 2026 15:28

Copilot started reviewing on behalf of Gudge (MGudgin) September 15, 2026 15:29 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Copilot AI review requested due to automatic review settings September 15, 2026 15:37

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from a0c379a to c669d4b Compare September 15, 2026 15:37

Copilot started reviewing on behalf of Gudge (MGudgin) September 15, 2026 15:44 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 15, 2026 15:54

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from c669d4b to d0adb32 Compare September 15, 2026 15:54

Gudge (MGudgin) requested a review from a team September 15, 2026 15:54

Copilot started reviewing on behalf of Gudge (MGudgin) September 15, 2026 15:55 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Copilot AI review requested due to automatic review settings September 15, 2026 16:14

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from d0adb32 to af1e2f8 Compare September 15, 2026 16:14

Copilot started reviewing on behalf of Gudge (MGudgin) September 15, 2026 16:15 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Soham Das (SohamDas2021) requested review from Soham Das (SohamDas2021) and a balanced review from Copilot September 15, 2026 16:25

Soham Das (SohamDas2021) previously approved these changes Sep 15, 2026

View reviewed changes

Copilot started reviewing on behalf of Soham Das (SohamDas2021) September 15, 2026 16:32 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 15, 2026 17:57

Gudge (MGudgin) dismissed Soham Das (SohamDas2021)’s stale review via 3575349 September 15, 2026 17:57

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from 5affc3b to d505c91 Compare September 16, 2026 18:58

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 18:59 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs

Copilot AI review requested due to automatic review settings September 16, 2026 21:26

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from d505c91 to 19f71d8 Compare September 16, 2026 21:26

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 21:27 View session

Copilot stopped reviewing on behalf of Gudge (MGudgin) due to an error September 16, 2026 21:27
An unexpected error occurred. For more details, see the detailed logs in GitHub Actions.

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from 19f71d8 to 5fecc4c Compare September 16, 2026 21:28

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread tests/scripts/run_bwrap_basic_test.sh Outdated

Comment thread tests/scripts/run_bwrap_cwd_preflight_test.sh Outdated

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Copilot AI review requested due to automatic review settings September 16, 2026 21:30

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 21:31 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs Outdated

Copilot AI review requested due to automatic review settings September 16, 2026 21:38

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from 5fecc4c to 4b16412 Compare September 16, 2026 21:38

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 21:39 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 16, 2026 21:44

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from 4b16412 to d64dbfe Compare September 16, 2026 21:44

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 21:45 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread src/backends/bubblewrap/common/src/bwrap_runner.rs

Copilot AI review requested due to automatic review settings September 16, 2026 21:57

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from d64dbfe to ebe9fe4 Compare September 16, 2026 21:57

Copilot started reviewing on behalf of Gudge (MGudgin) September 16, 2026 21:58 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 24, 2026 19:20

Gudge (MGudgin) force-pushed the user/gudge/mxc-507-bwrap-preflight branch from ebe9fe4 to c16d428 Compare September 24, 2026 19:20

Copilot started reviewing on behalf of Gudge (MGudgin) September 24, 2026 19:21 View session

Copilot AI reviewed Sep 24, 2026

View reviewed changes

		match working_directory_visibility(request, &target) {
		PathVisibility::Visible => {}

		reject a valid namespace path. Relative values retain the general verbatim
		behavior described above.

Conversation

Gudge (MGudgin) commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Tests

Uh oh!

azure-pipelines Bot commented Sep 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Gudge (MGudgin) commented Sep 14, 2026 •

edited

Loading