fix(testing): prepare native shell isolation on Linux

Signed-off-by: huangruiteng <14976749+huangruiteng@users.noreply.github.com>

Author: huangruiteng

.github/workflows/python-tests.yml

@@ -284,6 +284,23 @@ jobs:
         run: |
           python -m pip install --disable-pip-version-check -e ".[test]"
           npm ci --ignore-scripts
+      - name: Prepare native shell isolation
+        # Ubuntu 24.04 may need an executable-scoped userns profile for bwrap.
+        # Do not disable AppArmor or the system-wide unprivileged-userns guard.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap
+          if ! bwrap --unshare-all --ro-bind / / /bin/true; then
+            sudo tee /etc/apparmor.d/loopx-qualification-bwrap >/dev/null <<'PROFILE'
+          abi <abi/4.0>,
+          include <tunables/global>
+          profile loopx-qualification-bwrap /usr/bin/bwrap flags=(unconfined) {
+            userns,
+          }
+          PROFILE
+            sudo apparmor_parser -r /etc/apparmor.d/loopx-qualification-bwrap
+          fi
+          bwrap --unshare-all --ro-bind / / /bin/true
       - name: Run test shard
         # Split the whole collection, not a hand-maintained list of directories.
         # Without timing history least_duration alternates equal-weight tests.

loopx/control_plane/testing/vision_shell_host.py

@@ -99,6 +99,10 @@ def _sandbox(self) -> list[str]:
         argv = [str(shutil.which("bwrap")), "--unshare-all", "--die-with-parent", "--new-session", "--proc", "/proc", "--dev", "/dev"]
         for path in dict.fromkeys(readable):
             argv += ["--ro-bind", str(path), str(path)]
+        # usr-merged Linux needs the original loader and shell aliases too.
+        for name in ("/bin", "/sbin", "/lib", "/lib64"):
+            if Path(name).is_symlink():
+                argv += ["--symlink", os.readlink(name), name]
         argv += ["--bind", str(self.project), str(self.project)]
         for path in self.originals:
             argv += ["--ro-bind", str(path), str(path)]