[Soham Das (SohamDas2021)]

📖 Description

Stop automatically exposing host resolver Unix sockets to Bubblewrap sandboxes, closing a DNS egress-policy bypass. Expose only read-only resolver configuration while preserving DNS forwarding, symlink layouts, and filesystem-policy overrides.

🔗 References

Related: #1453.

🔍 Validation

Ubuntu WSL:

• From src/: cargo test -q -p mxc-sdk --lib bubblewrap::common -- --test-threads=1 — 391 passed.
• bash tests/scripts/run_bwrap_resolver_isolation_test.sh — 36 scenarios passed.
• All 16 non-sudo Bubblewrap suites passed, run individually from the run_bwrap_all_tests.sh registry; five sudo/root-dependent suites were not run.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See pull request builds.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See pull request builds
for the steps.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

🟡 Changes recommended

The resolver directory becomes read-only before sibling policy mount points can be created, causing valid sandbox launches to fail.

1 open issue

• Pre-create policy mount points before making snapshot read-only · New

What changed in this PR

This PR hardens Bubblewrap’s resolver setup against DNS egress-policy bypasses through host Unix sockets, while retaining the DNS forwarding introduced in #1453.

Changes:

• Replaces automatic resolver-directory mounts with sealed, read-only resolver snapshots and required symlink layouts.
• Integrates snapshot descriptors with sandbox startup and filesystem-policy ordering.
• Adds resolver isolation coverage, Linux CI checks, and backend documentation.

File	Description
tests/​scripts/​run_bwrap_resolver_isolation_test.sh	Adds resolver isolation and filesystem-policy scenarios.
tests/​scripts/​run_bwrap_all_tests.sh	Registers the resolver isolation suite.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​seccomp_filter.rs	Reuses the shared descriptor relocation helper.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​resolver_file.rs	Prepares sealed resolver snapshots and symlink layouts.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​proxy_network.rs	Shares descriptor handling and updates resolver denial checks.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​mod.rs	Registers the Linux-only resolver module.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_runner.rs	Integrates resolver mounts and descriptor inheritance.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_command.rs	Removes resolver-directory baseline mounts and accepts snapshot arguments.
docs/​development/​build-and-test/​ci-validation-infrastructure.md	Documents resolver validation coverage.
docs/​backends/​bwrap/​bubblewrap-backend.md	Explains resolver snapshots, socket isolation, and limitations.
.github/​workflows/​Build.Linux.Job.yml	Adds resolver unit tests to Linux validation.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Recreated resolver symlinks can cause previously valid filesystem grants to abort sandbox startup.

2 open issues

• Translate resolver grant paths through recreated symlinks · New
• Pre-create policy mount points before making snapshot read-only

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive mount translation has unresolved filesystem-policy defects and requires human review with host-level validation.

2 open issues

• Preserve child path restrictions after symlink translation · New
• Honor translated resolver grants in DNS pinning · New

2 resolved since last review

• Translate resolver grant paths through recreated symlinks
• Pre-create policy mount points before making snapshot read-only

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Automatic DNS pinning can overwrite an explicitly writable resolver granted through a symlink alias.

3 open issues

• Preserve child path restrictions after symlink translation
• Translated resolver grants are not recognized by pin suppression · New
• Honor translated resolver grants in DNS pinning

_{Review effort: Balanced}

[Branden Bonaby (bbonaby)]

question: does moving this to test affect anything? is it to catch a regression that this change fixes? Just wondering why test here but not before.

[Soham Das (SohamDas2021)]

The FD-relocation code moved to the shared helper, leaving this constant used only by the existing unit test. cfg(test) just avoids an unused-constant warning in normal builds; it isn’t adding a new regression check.

[Copilot]

🔵 Needs a closer look

Security-sensitive symlink reconstruction and filesystem mount ordering warrant final human verification beyond the reported WSL validation.

No open issues 🎉

3 resolved since last review

• Preserve child path restrictions after symlink translation
• Translated resolver grants are not recognized by pin suppression
• Honor translated resolver grants in DNS pinning

_{Review effort: Balanced}