probe: go deeper, and test the vendored bwrap either side of the flip

Author: charlesgreen

.github/workflows/probe-sandbox.yml

@@ -33,7 +33,25 @@ jobs:
         run: |
           set +e
           npm install -g @openai/codex@0.146.0 >/dev/null 2>&1
-          echo "=== binaries on PATH ==="
-          which codex; which codex-linux-sandbox
-          echo "=== what the package contains ==="
-          find "$(npm root -g)/@openai/codex" -maxdepth 3 -type f \( -name "codex*" -o -name "*sandbox*" \) 2>/dev/null | head -20
+          root="$(npm root -g)/@openai/codex"
+          echo "=== every file the package ships ==="
+          find "$root" -type f | head -40
+          echo "=== anything that looks like a sandbox helper ==="
+          find "$root" -type f \( -name "*bwrap*" -o -name "*sandbox*" \) 2>/dev/null
+
+      - name: Does the vendored bwrap work once the restriction is lifted
+        run: |
+          set +e
+          root="$(npm root -g)/@openai/codex"
+          bw="$(find "$root" -type f -name "*bwrap*" | head -1)"
+          echo "vendored bwrap: ${bw:-none found}"
+          [ -n "$bw" ] || exit 0
+          chmod +x "$bw"
+          echo "=== restriction ON (the current state) ==="
+          sysctl kernel.apparmor_restrict_unprivileged_userns
+          "$bw" --unshare-all --dev-bind / / true; echo "exit=$?"
+          echo "=== restriction OFF ==="
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          "$bw" --unshare-all --dev-bind / / true; echo "exit=$?"
+          echo "=== and a real command inside it ==="
+          "$bw" --unshare-all --dev-bind / / pwd; echo "exit=$?"