From db966f5d9d12270c6b029daa9f8b31e46988ae48 Mon Sep 17 00:00:00 2001
From: M3gA-Mind <elvin@tinyhumans.ai>
Date: Wed, 11 Nov 2026 19:06:07 +0530
Subject: [PATCH 1/2] Run the real-bubblewrap test suites in CI, refusing to
 skip

GitHub's ubuntu-latest is Ubuntu 24.04, where
kernel.apparmor_restrict_unprivileged_userns=1 makes every bwrap jail fail,
and tests/bwrap_isolation.rs and tests/bwrap_fd_leak.rs then print
"skipped" and pass. No job set TINYBOX_REQUIRE_BWRAP, so main's CI never ran
them. A bwrap-live job now makes unprivileged bwrap usable (new
scripts/ci/prepare-bwrap.sh, shared with the native-resource setup) and runs
both suites and the bwrap unit tests with TINYBOX_REQUIRE_BWRAP=1, so a skip
fails the job.
---
 .github/workflows/ci.yml                      | 21 +++++++++++++++++++
 scripts/ci/prepare-bwrap.sh                   | 14 +++++++++++++
 .../ci/prepare-rootless-native-resources.sh   |  4 +---
 3 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100755 scripts/ci/prepare-bwrap.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 353c2aa5..081ab3be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,27 @@ jobs:
           export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_dir/bus"
           TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module native_
           TINYBOX_REQUIRE_NATIVE_RESOURCE_TESTS=1 cargo test -j1 -p tinybox-module resource_aware_bus_exec_cancellation_reports_events_and_reaps_descendants
+  # The real-bubblewrap suites. They skip when bwrap cannot run (Ubuntu 24.04
+  # blocks unprivileged user namespaces by default), so this job makes bwrap
+  # usable and requires it: a skip here is a failure, not a pass.
+  bwrap-live:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249
+      - name: Make unprivileged bubblewrap usable
+        run: |
+          source scripts/ci/prepare-bwrap.sh
+      - name: Run the real-bubblewrap suites, refusing to skip
+        shell: bash
+        env:
+          TINYBOX_REQUIRE_BWRAP: "1"
+        run: |
+          set -euo pipefail
+          cargo test --locked -p tinybox-jail --test bwrap_isolation --test bwrap_fd_leak -- --nocapture
+          cargo test --locked -p tinybox-jail --lib bwrap
   docker-network-live:
     name: Docker Egress and denied network connectivity
     runs-on: ubuntu-22.04
diff --git a/scripts/ci/prepare-bwrap.sh b/scripts/ci/prepare-bwrap.sh
new file mode 100755
index 00000000..a55a01ee
--- /dev/null
+++ b/scripts/ci/prepare-bwrap.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Make unprivileged bubblewrap usable on a GitHub Linux runner: install it and
+# lift Ubuntu 24.04's AppArmor restriction on unprivileged user namespaces,
+# which otherwise makes every bwrap jail fail (and its tests skip).
+set -euo pipefail
+
+if ! command -v bwrap >/dev/null 2>&1; then
+    sudo apt-get update
+    sudo apt-get install --yes bubblewrap
+fi
+if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
+    sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+fi
+bwrap --version
diff --git a/scripts/ci/prepare-rootless-native-resources.sh b/scripts/ci/prepare-rootless-native-resources.sh
index 8579c78d..cf631605 100644
--- a/scripts/ci/prepare-rootless-native-resources.sh
+++ b/scripts/ci/prepare-rootless-native-resources.sh
@@ -10,9 +10,7 @@ sudo systemctl start "user@${uid}.service"
 runtime_dir="/run/user/${uid}"
 export XDG_RUNTIME_DIR="$runtime_dir"
 export DBUS_SESSION_BUS_ADDRESS="unix:path=$runtime_dir/bus"
-if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
-    sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-fi
+source "$(dirname "${BASH_SOURCE[0]}")/prepare-bwrap.sh"
 
 systemctl --user show-environment >/dev/null
 systemd-run --user --scope --quiet --property=CPUQuota=10% -- /bin/true

From 214475b4d7ce32acd533773c28a3cc0728c14ea1 Mon Sep 17 00:00:00 2001
From: M3gA-Mind <elvin@tinyhumans.ai>
Date: Wed, 11 Nov 2026 19:06:47 +0530
Subject: [PATCH 2/2] Remove the image's pasta in bwrap-live so the
 shared-network path stays tested

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 081ab3be..8d34e7ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,6 +57,12 @@ jobs:
       - name: Make unprivileged bubblewrap usable
         run: |
           source scripts/ci/prepare-bwrap.sh
+      # The image ships passt (a podman Recommends). Without it this job keeps
+      # the default shared-network path covered; the pasta job covers the other.
+      - name: Remove pasta so the shared-network path is the one tested
+        run: |
+          if dpkg -s passt >/dev/null 2>&1; then sudo apt-get remove --yes passt; fi
+          if command -v pasta >/dev/null 2>&1; then echo "pasta still present" >&2; exit 1; fi
       - name: Run the real-bubblewrap suites, refusing to skip
         shell: bash
         env: