[Soham Das (SohamDas2021)]

📖 Description

Drop all Bubblewrap workload capabilities with --cap-drop ALL, including when MXC is invoked as root. The separate network supervisor retains the capabilities needed to configure CIDR filtering and proxy-only egress.

Add root and non-root regression coverage across isolated, firewall, and proxy modes. The tests check capability removal, privileged socket denial, read-only mount protection, firewall tamper resistance, and working permitted connections. They run in PR and scheduled validation. A missing firewall fixture address no longer prevents the isolated and proxy checks from running; incomplete coverage still fails CI.

Part 1 of 2. UID/GID mappings are unchanged. Root callers still give workloads root-owner access to exposed host files; identity remapping is separate follow-up work.

This corrects existing containment enforcement without changing request schemas or public APIs; no design spec is required.

🔗 References

No public issue linked.

🔍 Validation

Validated on Ubuntu WSL2 with Bubblewrap 0.9.0. Rust commands ran from src/ with a native Linux PATH.

• cargo fmt --all -- --check — passed.
• cargo clippy --locked -p mxc-sdk --lib --quiet -- -D warnings — passed.
• cargo test --locked -p mxc-sdk --lib --test streaming_bubblewrap --test wxc_e2e_tests_e2e_bubblewrap_characterization bubblewrap --quiet — passed: 449 unit, 16 streaming, and 13 matching characterization tests; 2 ignored.
• cargo test --locked -p mxc-sdk --test wxc_e2e_tests_e2e_bubblewrap_characterization --quiet — passed: all 15 characterization tests.
• bash tests/scripts/run_bwrap_capabilities_test.sh — passed in all three modes.
• sudo env LXC_EXEC="$LXC_EXEC" bash tests/scripts/run_bwrap_capabilities_test.sh — passed in all three modes as root.
• bash tests/scripts/run_bwrap_firewall_test.sh, bash tests/scripts/run_bwrap_directional_test.sh, and bash tests/scripts/run_bwrap_network_proxy_test.sh — each passed.
• for suite in filesystem filesystem_object most_specific denied_masking; do bash "tests/scripts/run_bwrap_${suite}_test.sh"; done — all four passed.
• sudo env LXC_EXEC="$LXC_EXEC" bash tests/scripts/run_bwrap_inbound_deny_test.sh — passed, including IPv4/IPv6 rules and dropped inbound packet counters.

The capability regression failed on the unmodified root-launch path in all three modes. Mocked QEMU-style interface discovery confirmed isolated/proxy checks continue when firewall coverage skips, and failures retain precedence over skips. The root run preceded the test-only skip-handling follow-up; the follow-up was checked without elevation.

Known pre-existing failure: bash tests/scripts/run_bwrap_namespace_startup_test.sh fails at the rule-installation failure scenario identically on unmodified main (37a3e93).

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• For features or changes requiring a spec: linked the issue with maintainer-applied feature-accepted
• For implementation: linked the required approved and merged design/API spec, or explained why no spec is required
• Feature issue remains open unless this PR completes all agreed implementation, validation, and documentation
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the change to drop workload capabilities while preserving the network supervisor’s filtering authority.

No open issues 🎉

What changed in this PR

This PR hardens MXC’s Bubblewrap backend by explicitly dropping all workload capabilities, including for root callers, while preserving the network supervisor’s ability to configure filtering. UID/GID mappings remain unchanged.

Changes:

• Adds --cap-drop ALL to the shared command builder and updates argument parsing and unit coverage.
• Adds root and non-root regression coverage for isolated, firewall, and proxy modes, wired into PR and scheduled validation.
• Documents capability enforcement, remaining root-identity risks, and incomplete-coverage handling.

File	Description
tests/​scripts/​run_bwrap_capabilities_test.sh	Adds capability, socket, mount, firewall, and connectivity regression checks across three modes.
tests/​scripts/​run_bwrap_all_tests.sh	Registers the capability suite and updates the explanation for requiring non-root execution.
tests/​scripts/​README.md	Documents the new suite, prerequisites, and skip behavior.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_command.rs	Drops all workload capabilities and updates layout parsing and security-option tests.
scripts/​ci/​run_backend_validation_tests.sh	Adds root capability validation and rejects failures or skips.
docs/​development/​build-and-test/​ci-validation-infrastructure.md	Describes root and non-root capability coverage in CI.
docs/​backends/​bwrap/​bubblewrap-backend.md	Explains explicit capability removal, supervisor authority, and unchanged identity limitations.
.github/​workflows/​Build.Linux.Job.yml	Runs capability regressions as both unprivileged and root users.

_{Review effort: Balanced}