docs(fspy): record Chromium sandbox boundary

Co-authored-by: GPT-5 Codex <codex@openai.com>

Author: wan9chi

.github/workflows/fspy-sigsys-research.yml

@@ -48,7 +48,7 @@ jobs:
           ./nonleader_exec /bin/true
 
   vitest-browser-x86:
-    name: Sandboxed Vitest browser under transient ptrace
+    name: Chromium sandbox compatibility boundary
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -85,20 +85,36 @@ jobs:
             pnpm --filter vite-task-tools exec node --input-type=module \
             --eval "$sandbox_control"
 
-      - name: Run sandboxed Vitest browser mode through the exec bridge
+      - name: Validate Vitest browser modes through the exec bridge
         run: |
           set -euxo pipefail
           test "$(uname -m)" = x86_64
 
           make -C research/ptrace-exec-prototype recursive_injector
           probe_dir=$(mktemp -d)
           cp -a crates/vite_task_bin/tests/e2e_snapshots/fixtures/vitest_browser_cache \
-            "$probe_dir/fixture"
+            "$probe_dir/default"
+          cp -a crates/vite_task_bin/tests/e2e_snapshots/fixtures/vitest_browser_cache \
+            "$probe_dir/sandboxed"
           ln -s "$PWD/packages/tools/node_modules" "$probe_dir/node_modules"
 
           injector="$PWD/research/ptrace-exec-prototype/recursive_injector"
           vitest="$PWD/packages/tools/node_modules/.bin/vitest"
-          cd "$probe_dir/fixture"
+
+          cd "$probe_dir/default"
+          VITEST_CHROMIUM_SANDBOX=false \
+            DEBUG=vitest:browser:playwright,pw:browser \
+            timeout 120s "$injector" "$vitest" run \
+            2>&1 | tee "$probe_dir/default.log"
+          test -s dist/result.json
+          grep -F '"success":true' dist/result.json
+          grep -F 'chromiumSandbox: false' "$probe_dir/default.log"
+          grep -E 'bridge: injected exec .*exe=.*/(chrome|headless_shell)' \
+            "$probe_dir/default.log"
+          grep -E 'bridge: summary injected_execs=[2-9][0-9]* failed_execs=0' \
+            "$probe_dir/default.log"
+
+          cd "$probe_dir/sandboxed"
 
           sandbox_record="$probe_dir/chromium-sandbox.txt"
           no_sandbox_record="$probe_dir/chromium-no-sandbox.txt"
@@ -150,23 +166,21 @@ jobs:
 
           kill "$observer_pid" 2>/dev/null || true
           wait "$observer_pid" 2>/dev/null || true
-          if test "$run_status" -ne 0; then
-            sudo dmesg | tail -200 || true
-          fi
-          test "$run_status" -eq 0
+          test "$run_status" -ne 0
 
           test -s dist/result.json
-          grep -F '"success":true' dist/result.json
+          grep -F '"success":false' dist/result.json
           grep -F 'chromiumSandbox: true' "$probe_dir/bridge.log"
           test ! -s "$no_sandbox_record"
-          test -s "$sandbox_record"
-          grep -F $'NoNewPrivs:\t1' "$sandbox_record"
-          grep -F $'Seccomp:\t2' "$sandbox_record"
-          grep -E $'Seccomp_filters:\t([2-9]|[1-9][0-9]+)' "$sandbox_record"
-          cat "$sandbox_record"
-          grep -E 'bridge: injected exec .*exe=.*/(chrome|headless_shell)' \
+          test ! -s "$sandbox_record"
+          grep -E 'bridge: exec argv .* --type=zygote ' "$probe_dir/bridge.log"
+          grep -F 'bridge: zygote fd 3=socket:' "$probe_dir/bridge.log"
+          grep -F 'fspy: recvmsg returned EOF' "$probe_dir/bridge.log"
+          grep -F 'FATAL:content/browser/zygote_host/zygote_host_impl_linux.cc:207' \
             "$probe_dir/bridge.log"
-          grep -E 'bridge: summary injected_execs=[2-9][0-9]* failed_execs=' \
+          grep -F 'ZygoteMain: initializing' "$probe_dir/bridge.log"
+          grep -F 'write: Broken pipe (32)' "$probe_dir/bridge.log"
+          grep -E 'bridge: summary injected_execs=[2-9][0-9]* failed_execs=0' \
             "$probe_dir/bridge.log"
 
   docker-x86:

docs/fspy-linux-sigsys-research.md

@@ -2,7 +2,7 @@
 
 Research date: 2026-08-02
 
-Status: feasibility proven on native Linux AArch64 and x86-64, including Vitest browser mode and Docker's default seccomp and AppArmor profiles
+Status: feasibility proven on native Linux AArch64 and x86-64, including default Vitest browser mode and Docker's default seccomp and AppArmor profiles. Playwright's `chromiumSandbox: true` is a confirmed compatibility boundary for the current ptrace exec bridge.
 
 Primary audience: fspy maintainers deciding whether to replace the Linux `LD_PRELOAD` and seccomp user-notification backends.
 
@@ -13,7 +13,8 @@ The design is feasible for fspy's unprivileged build-tool workload. Use `SECCOMP
 Use two exec bridges, selected by a startup probe:
 
 1. Prefer a temporary ptrace attachment around a real target exec. This preserves kernel ELF, script, identity, and failure semantics.
-2. If ptrace is denied or already owned, real-exec a static `fspy_host` and load the target in user space. This path works for the tested frontend workload but has a narrower, documented exec contract.
+2. Do not use that bridge for Chromium's namespace-sandbox zygote exec. The current bridge breaks Chromium's synchronous zygote boot handshake before Chromium installs its seccomp policy.
+3. If ptrace is denied, already owned, or incompatible with a namespace-sandbox launch, real-exec a static `fspy_host` and load the target in user space. This path works for the tested frontend workload but has a narrower, documented exec contract. Sandboxed Chromium still needs a dedicated userland-loader validation.
 
 The preferred ptrace bridge is:
 
@@ -67,7 +68,8 @@ The primary experiments ran on Ubuntu 24.04 AArch64, Linux 6.8, in a four-vCPU L
 | Can nested and concurrent traps work?                                    | Yes; `SA_NODEFER`, a nested trap, and 200,000 calls from four threads passed                         |
 | Can Go replace or block `SIGSYS` without breaking fspy?                  | The prototype virtualized the tested `rt_sigaction` and `rt_sigprocmask` operations; esbuild passed  |
 | Can a real exec regain the handler before target entry?                  | Yes; post-exec ptrace injection passed for dynamic, static, non-leader, and esbuild execs            |
-| Can a recursive on-demand ptrace bridge run Vitest browser mode?         | Yes; Vitest 4.1.10 and Playwright Chromium passed through nine exec reinjections on native x86-64    |
+| Can a recursive on-demand ptrace bridge run Vitest browser mode?         | Yes with Playwright's default `--no-sandbox`; nine exec reinjections passed on native x86-64         |
+| Does the same bridge support `chromiumSandbox: true`?                    | No; the namespace zygote handshake reaches EOF at its ptrace exec boundary before Chromium seccomp   |
 | Can the proposed static-host cycle bootstrap under the inherited filter? | Yes; a real exec into a static-musl second stage reinstalled the handler through the trusted gateway |
 | Can a pure handoff run frontend tools?                                   | Yes; Node and esbuild 0.28.1 CLI/API paths, static Go, static musl, shells, and coreutils passed     |
 
@@ -159,7 +161,33 @@ A subtle signal-mask rule is mandatory. `SIGSYS` is automatically blocked while
 
 The native x86-64 [Vitest browser validation](https://github.com/voidzero-dev/vite-task/actions/runs/30735989574) ran the repository's real fixture with Node 22.19.0, Vitest 4.1.10, `@vitest/browser-playwright` 4.1.10, Playwright 1.61.1, and Chrome Headless Shell 149.0.7827.55. It reinjected nine successful images—dash, sed, dirname, uname, Node, and four Chromium processes—with zero failed execs. The browser test and JSON report passed while the inherited filter trapped and reissued the representative file-syscall set: `openat`, `openat2`, `newfstatat`, `statx`, `getdents64`, `faccessat`, and `faccessat2`.
 
-This proves compatibility with Vitest's default Playwright Chromium launch, which disables Chromium's sandbox unless `chromiumSandbox: true` is requested. It does not yet prove coexistence with Chromium's own sandbox seccomp policy and `SIGSYS` handler.
+This proves compatibility with Vitest's default Playwright Chromium launch, which disables Chromium's sandbox unless `chromiumSandbox: true` is requested.
+
+### `chromiumSandbox: true` fails at the namespace-zygote exec boundary
+
+The current ptrace exec bridge does not support Playwright's `chromiumSandbox: true`. This is a confirmed negative result, not a missing host prerequisite.
+
+The native Ubuntu 24.04 validation established these controls:
+
+- A direct Playwright launch with `chromiumSandbox: true` passed.
+- The same direct launch under `setpriv --no-new-privs` passed.
+- The full bridge continued to pass Vitest with Playwright's default `chromiumSandbox: false`.
+- The sandboxed launch used no `--no-sandbox` argument.
+
+Ubuntu 24.04's AppArmor policy restricts unprivileged user namespaces by default on the GitHub runner. The validation explicitly set `kernel.apparmor_restrict_unprivileged_userns=0`. Without that host setup, Chromium fails earlier with `No usable sandbox`; that is a separate environment failure.
+
+With the host prerequisite satisfied, the bridged launch fails in this order:
+
+1. The bridge injects the main Chrome image successfully.
+2. Chrome creates its namespace zygote and the bridge injects that exec successfully. `/proc/<zygote>/fd/3` still reports the inherited Unix socket.
+3. The browser's blocking `recvmsg` returns zero at the zygote exec boundary. Chromium fails `ReceiveFixedMessage` at `zygote_host_impl_linux.cc:207` before receiving `ZYGOTE_BOOT`.
+4. The zygote reaches `ZygoteMain` after detach. Its later control-socket write reports `EPIPE` because the browser has already abandoned the handshake.
+
+The [full-filter diagnostic run](https://github.com/voidzero-dev/vite-task/actions/runs/30737025514) captured the zero-length receive, the preserved fd 3, and the later broken pipe. An [exec-and-signal-only filter run](https://github.com/voidzero-dev/vite-task/actions/runs/30737143580) failed at the same point. The representative file-syscall traps are therefore not the cause.
+
+Chromium's own seccomp policy is not active at this failure point. Forwarding a foreign `SECCOMP_RET_TRAP` to the target's logical `SIGSYS` handler and installing fspy's physical handler with `SA_NODEFER` are still required. The standalone nested-filter test validates those mechanics, but they do not fix this earlier zygote handshake.
+
+Treat namespace-sandbox zygote exec as a ptrace incompatibility until a different rendezvous proves otherwise. A production hybrid should route this exec through the static-host userland loader or decline tracing with an actionable error. It must make that choice before attempting the ptrace exec because Chromium treats the failed boot handshake as fatal.
 
 This path preserves the parts of exec that frontend tools depend on:
 
@@ -230,16 +258,16 @@ The static host also needs a target-independent payload ABI. The current `Payloa
 | Environment                  | RET_TRAP syscall path | Temporary ptrace exec     | Evidence or required handling                                         |
 | ---------------------------- | --------------------- | ------------------------- | --------------------------------------------------------------------- |
 | Native Linux AArch64         | Passed                | Passed                    | Ubuntu 24.04/Linux 6.8; dynamic, static, esbuild, and non-leader exec |
-| Native Linux x86-64          | Passed                | Passed                    | Ubuntu 24.04 GitHub runner; dynamic, non-leader, Node, and Chromium   |
+| Native Linux x86-64          | Passed                | Passed with boundary      | Ubuntu 24.04; default Chromium passes, namespace-sandbox zygote fails |
 | WSL2                         | Expected              | Expected, untested        | Avoid `NEW_LISTENER`; test mirrored networking and ptrace policy      |
 | Rootless containerd          | Passed                | Passed                    | Existing seccomp filter; also passed with `no_new_privs=1`            |
 | Docker default on Linux      | Passed                | Passed                    | Existing filter, `no_new_privs=1`, enforced default AppArmor          |
 | Docker Desktop amd64/Rosetta | Unsupported           | Not reached               | Local `PR_SET_SECCOMP` returned `EINVAL`; use a native-arch image     |
 | Kubernetes                   | Runtime-dependent     | Runtime and LSM-dependent | Probe and fall back; test containerd/CRI-O RuntimeDefault profiles    |
-| Hosted CI                    | Passed on GitHub      | Passed on GitHub          | Other providers still need the startup probe                          |
+| Hosted CI                    | Passed on GitHub      | Passed with boundary      | GitHub passes except sandboxed Chromium; other providers need a probe |
 | Custom sandbox               | Policy-dependent      | Often denied              | Use the userland fallback or report an actionable error               |
 
-The latest native x86-64, Vitest browser, and Docker evidence is recorded in [GitHub Actions run 30735989574](https://github.com/voidzero-dev/vite-task/actions/runs/30735989574). The Docker recursive bridge passed with `Seccomp: 2`, `NoNewPrivs: 1`, and `docker-default (enforce)`. The Rosetta result is an emulation limitation, not a failure of native x86-64 Docker.
+The default-browser native x86-64 and Docker evidence is recorded in [GitHub Actions run 30735989574](https://github.com/voidzero-dev/vite-task/actions/runs/30735989574). The Docker recursive bridge passed with `Seccomp: 2`, `NoNewPrivs: 1`, and `docker-default (enforce)`. The sandboxed-Chromium boundary is recorded separately in [run 30737025514](https://github.com/voidzero-dev/vite-task/actions/runs/30737025514). The Rosetta result is an emulation limitation, not a failure of native x86-64 Docker.
 
 The open [WSL issue about seccomp notification](https://github.com/microsoft/WSL/issues/9548) concerns the single `NEW_LISTENER` restriction when WSL mirrored networking already owns a listener. It does not prevent stacking a normal `RET_TRAP` filter. The current WSL kernel configuration enables seccomp filtering.
 

research/ptrace-exec-prototype/README.md

@@ -76,9 +76,26 @@ never reaches `rt_sigreturn`, so the new image otherwise inherits `SIGSYS`
 blocked and dies on its first trapped syscall. The handler must explicitly
 unblock physical `SIGSYS` immediately before issuing the gateway exec.
 
-The Vitest fixture uses Playwright's default unsandboxed Chromium launch. A
-future test must enable `chromiumSandbox: true` to validate interaction with
-Chromium's own seccomp policy and logical `SIGSYS` handler.
+The default-browser result does not extend to Playwright's
+`chromiumSandbox: true`. Native Ubuntu 24.04 controls launched sandboxed
+Chromium both normally and under `no_new_privs`. Through the bridge, however,
+the namespace zygote exec leaves fd 3 present while the browser side of the
+boot socket observes EOF. Chromium aborts at
+`zygote_host_impl_linux.cc:207`; the zygote later reaches `ZygoteMain` and gets
+`EPIPE` after the browser closes its end.
+
+The [full-filter run](https://github.com/voidzero-dev/vite-task/actions/runs/30737025514)
+captured that sequence. An
+[exec-and-signal-only run](https://github.com/voidzero-dev/vite-task/actions/runs/30737143580)
+failed at the same boundary, so the file-syscall passthrough is not the cause.
+The failure precedes Chromium's own seccomp setup. The nested-filter test still
+proves that fspy can identify its filter tag, forward a foreign seccomp trap to
+the target's logical `SIGSYS` action, and permit reentrant delivery with
+`SA_NODEFER`.
+
+Do not use this ptrace bridge for Chromium namespace-zygote execs. A production
+hybrid must select the static-host userland loader before attempting that exec,
+or reject the launch with an actionable compatibility error.
 
 ## Prototype boundaries
 
@@ -102,6 +119,7 @@ Chromium's own seccomp policy and logical `SIGSYS` handler.
 - The recursive prototype uses direct pointer loads while virtualizing signal
   APIs and only reissues file syscalls; it does not yet perform fault-safe path
   capture or write fspy events to shared memory.
-- Its logical `SIGSYS` model is intentionally incomplete. Per-thread virtual
-  masks, delivery to a target-installed logical handler, and coexistence with
-  another seccomp `TRAP` producer remain production work.
+- Its logical `SIGSYS` model is intentionally incomplete. The prototype
+  forwards a tagged foreign trap to the tested target handler, but per-thread
+  virtual masks, complete action semantics, and general coexistence with other
+  seccomp producers remain production work.

research/ptrace-exec-prototype/recursive_injector.c

@@ -153,33 +153,13 @@ __asm__(
     "  mov (%r13,%rcx), %rsi\n"
     "  mov fspy_recursive_slot_rdx(%rip), %rcx\n"
     "  mov (%r13,%rcx), %rdx\n"
-    "  mov 40(%rsi), %r8\n" /* preserve msghdr.msg_controllen */
-    "  xor %r10d, %r10d\n"  /* one zero-length record may be skipped */
-    ".Lfspy_recvmsg_retry:\n"
     "  mov fspy_recursive_slot_magic(%rip), %r9\n"
     "  mov $47, %eax\n" /* __NR_recvmsg */
     "  syscall\n"
     "  mov %rax, %r15\n"
     "  test %rax, %rax\n"
     "  js .Lfspy_recvmsg_error\n"
-    "  jnz .Lfspy_recvmsg_positive\n"
-    "  test %r10d, %r10d\n"
-    "  jnz .Lfspy_recvmsg_eof\n"
-    "  mov $1, %r10d\n"
-    "  mov %r8, 40(%rsi)\n"
-    "  lea .Lfspy_recvmsg_retry_message(%rip), %rsi\n"
-    "  mov $34, %edx\n"
-    "  mov $2, %edi\n"
-    "  mov $1, %eax\n" /* __NR_write */
-    "  syscall\n"
-    "  mov fspy_recursive_slot_rsi(%rip), %rcx\n"
-    "  mov (%r13,%rcx), %rsi\n"
-    "  mov fspy_recursive_slot_rdi(%rip), %rcx\n"
-    "  mov (%r13,%rcx), %rdi\n"
-    "  mov fspy_recursive_slot_rdx(%rip), %rcx\n"
-    "  mov (%r13,%rcx), %rdx\n"
-    "  jmp .Lfspy_recvmsg_retry\n"
-    ".Lfspy_recvmsg_positive:\n"
+    "  jz .Lfspy_recvmsg_eof\n"
     "  lea .Lfspy_recvmsg_positive_message(%rip), %rsi\n"
     "  mov $32, %edx\n"
     "  jmp .Lfspy_recvmsg_log\n"
@@ -410,7 +390,6 @@ __asm__(
     ".Lfspy_recvmsg_error_message: .ascii \"fspy: recvmsg returned error\\n\"\n"
     ".Lfspy_recvmsg_eintr_message: .ascii \"fspy: recvmsg returned EINTR\\n\"\n"
     ".Lfspy_recvmsg_enoent_message: .ascii \"fspy: recvmsg returned ENOENT\\n\"\n"
-    ".Lfspy_recvmsg_retry_message: .ascii \"fspy: recvmsg skipped zero record\\n\"\n"
     ".balign 8\n"
     "fspy_recursive_slot_rax: .quad 0\n"
     "fspy_recursive_slot_rdi: .quad 0\n"