Warn about hidden Bubblewrap resolver targets

[Gudge (MGudgin)]

This PR adds an advisory warning when a direct, absolute /etc/resolv.conf
symlink points to a canonical regular file clearly outside Bubblewrap's
mounts. It names a read-only policy remedy or link repair without changing
mounts or the execution outcome.

Part of #507. This is the separate resolver diagnostic recommended when #1160 was closed; the cwd advisory is #1442. Neither PR alone closes #507.

Details

• Check baseline, virtual, and policy mount destinations conservatively;
  defer relative, chained, and ambiguous resolver paths to Bubblewrap.
• Compare mount paths by components so repeated or trailing separators
  cannot cause false warnings.
• Cover root and emitted mount destinations in command-builder tests.
• Test a real temporary resolver symlink and file without changing host
  /etc, and document SDK/CLI warning delivery.

Tests

• From src/, cargo fmt --all -- --check: passed.
• cargo check -p mxc-sdk --all-targets --quiet: passed.
• cargo clippy -p mxc-sdk --all-targets --quiet -- -D warnings: passed.
• cargo test -p mxc-sdk --lib bwrap_command --quiet: 52 passed on Windows, including separator cases.
• cargo check -p mxc-sdk --target x86_64-unknown-linux-gnu --all-targets --quiet: passed.
• cargo clippy -p mxc-sdk --target x86_64-unknown-linux-gnu --all-targets --quiet -- -D warnings: passed.
• Ubuntu 26.04 ARM64 WSL (src/), CARGO_TARGET_DIR="$HOME/src/microsoft/mxc/mxc.root/src/target" cargo test -p mxc-sdk --lib bubblewrap::common --quiet -- --test-threads=1: 306 passed.
• CARGO_TARGET_DIR="$HOME/src/microsoft/mxc/mxc.root/src/target" cargo build -p lxc --quiet: passed; the built lxc-exec --experimental ../tests/configs/bubblewrap_basic.json smoke passed ("Hello from Bubblewrap").
• The real temporary resolver symlink test ran within the Rust suite; host /etc/resolv.conf was not modified.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Path overlap mishandles separator variants, causing false warnings for covered resolver targets.

1 open finding

• Handle trailing and repeated slashes in mount path overlap checks · New

What changed in this PR

Adds a conservative Bubblewrap warning when /etc/resolv.conf targets a file hidden from the sandbox.

Changes:

• Detects hidden direct resolver symlink targets.
• Retains warnings for SDK/CLI callers.
• Adds focused tests and backend documentation.

File	Description
bwrap_runner.rs	Emits and tests resolver warnings.
bwrap_command.rs	Determines whether mounts cover the target.
bubblewrap-backend.md	Documents warning behavior and remediation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The implementation is conservative, well-tested, and preserves existing mount and execution behavior.

1 open finding

• Handle trailing and repeated slashes in mount path overlap checks

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Virtual mounts are incorrectly treated as exposing host resolver files, suppressing required warnings.

0 open findings

1 resolved since last review

• Handle trailing and repeated slashes in mount path overlap checks

Previously missed (2)

In code that hasn't changed since last review

Avoid treating tmpfs and symlinks as host-content mounts

src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_command.rs:119

/tmp and /var/run are not host-content mounts. --tmpfs /tmp creates an empty filesystem, and --symlink /run /var/run only redirects lookup; neither makes a host resolver file such as canonical /tmp/resolv.conf or /var/run/custom/resolv.conf available. Treating these destinations as overlap therefore suppresses the advisory for targets that are clearly hidden, contrary to the PR's stated behavior (the new test even incorrectly classifies /tmp/resolv.conf as covered). Count only mounts that expose the target's host contents, and handle /var/run by checking the corresponding /run target against actual bind mounts rather than considering the whole subtree covered.

Correct test expectation for hidden files under tmpfs

src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_command.rs:511

This expectation encodes the same incorrect assumption: Bubblewrap's --tmpfs /tmp is empty and does not expose the host file /tmp/resolv.conf. This case should assert that the target is hidden so the regression test exercises the promised diagnostic.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.