feat(jail): bubblewrap backend with real process isolation on Linux

crates/tinybox-core/src/capability/types.rs

@@ -14,10 +14,16 @@ pub enum IsolationLevel {
     /// launching user's full privileges.
     None,
     /// The workload runs under a separate user or working directory, but shares
-    /// the host's process table and filesystem view.
+    /// the host's process table and filesystem view. A namespace backend that
+    /// cannot guarantee [`IsolationLevel::Kernel`] for every configuration (for
+    /// example, because the host network is shared) also reports this level as
+    /// its conservative minimum; it then states its per-configuration level
+    /// separately.
     Process,
-    /// Separate namespaces and cgroups. The workload cannot see host processes
-    /// or escape its root, but shares the host kernel.
+    /// Separate pid, mount, user and ipc (and, where stated, network)
+    /// namespaces. The workload cannot see host processes or reach paths
+    /// outside its root, but shares the host kernel. It does not imply a
+    /// seccomp filter or resource limits.
     Kernel,
     /// A separate kernel behind a hypervisor boundary.
     Hardware,

crates/tinybox-jail/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tinybox-jail"
-description = "Per-process directory jail for spawned commands: Landlock, Seatbelt, and AppContainer."
+description = "Per-process directory jail for spawned commands: bubblewrap, Landlock, Seatbelt, and AppContainer."
 documentation = "https://docs.rs/tinybox-jail"
 version.workspace = true
 edition.workspace = true
@@ -30,6 +30,9 @@ serde_json.workspace = true
 
 [target.'cfg(target_os = "linux")'.dependencies]
 landlock = { version = "0.4", optional = true }
+# `NamespaceProbe` locates `bwrap`; reused so there is one definition of how the
+# Linux backends find it.
+tinybox-linux.workspace = true
 
 [target.'cfg(windows)'.dependencies]
 # AppContainer profile APIs, ACL editing, STARTUPINFOEXW process spawn, and the
@@ -47,5 +50,11 @@ windows-sys = { version = "0.61", features = [
 [dev-dependencies]
 tempfile = "3"
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+# Clears close-on-exec on a descriptor in the fd-leak regression test; the safe
+# `fcntl_setfd` avoids `unsafe`, which the workspace forbids. Already in the
+# lockfile through tempfile.
+rustix = { version = "1", default-features = false, features = ["std", "fs"] }
+
 [lints]
 workspace = true

crates/tinybox-jail/README.md

@@ -20,7 +20,9 @@ spawns, never the core process itself.
   root the same access as the root (Landlock rule, Seatbelt `file-write*`
   subpath, `AppContainer` ACL), for host-owned scratch such as a per-call
   output-capture directory that must not land inside the root.
-- Cache the default backend: Landlock on Linux kernels that support it,
+- Cache the default backend: bubblewrap on Linux when `bwrap` is installed and
+  unprivileged user namespaces work (real process isolation, suitable for
+  untrusted code), else Landlock on kernels that support it,
   Seatbelt on macOS, otherwise the `unsupported` backend.
 - Spawn a `std::process::Command` inside the jail, canonicalizing `root`
   (and the read-only and read/write paths) first so backends never see `..` or symlink
@@ -39,6 +41,7 @@ spawns, never the core process itself.
 | `crates/tinybox-jail/src/jail.rs` | Core types: the `Jail` description struct (builder plus `canonicalize`/`canonicalize_or_log`) and the `JailBackend` trait (`name`/`is_available`/`spawn`). |
 | `crates/tinybox-jail/src/detect.rs` | `pick_backend()`: first available OS backend, else an unsupported backend that fails closed. |
 | `crates/tinybox-jail/src/noop.rs` | `NoopBackend`: no enforcement, plain `Command::spawn`. Always available. |
+| `crates/tinybox-jail/src/bwrap/` | Bubblewrap backend (Linux only): user/pid/ipc/uts (+net) namespaces, grants as bind mounts, `deny_read` masked, `--die-with-parent`. `isolation()` is the minimum over configurations (`Process` with `--disable-userns`, else `None`); `Kernel` only per jail without `allow_net` (`isolation_for` / `is_suitable_for_untrusted_jail`; hosts must use the per-jail form). Never looks `bwrap` up on `PATH`; the probe is a sanity check, not authentication, and `with_program` skips the ownership check. The caller's environment and credentials travel in a private `--args` file, not in argv or any host process environment (`launcher.rs`), and inherited descriptors above 2 are closed by that launcher. No seccomp filter and no resource limits yet. Landlock is the fallback. Landlock is not layered inside because the kernel denies `mount` to a Landlock-restricted thread. |
 | `crates/tinybox-jail/src/linux.rs` | Landlock backend (Linux only, `landlock` feature, on by default). Applies the ruleset to a dedicated spawn thread so no `unsafe` `pre_exec` is needed. |
 | `crates/tinybox-jail/src/macos.rs` | Seatbelt backend via `sandbox-exec`. Compiled on every host so the profile renderer is unit-tested everywhere; selected only on macOS. |
 | `crates/tinybox-jail/src/windows.rs` | AppContainer implementation; **not compiled**: it needs `unsafe` FFI the workspace forbids and cannot return a waitable `std::process::Child` yet. |