Module namespace_probe 

The one place the host’s namespaces are probed.

Every decision that depends on what namespaces this host can give a capsule reads a NamespaceReading: the E-CAP-005 network-namespace check, whether a command’s literal /tmp can be mapped onto the session’s temporary folder, whether sealed is refused (E-CAP-003), the enforcement tier, mur run --explain-scope and mur doctor. A reading is taken once per crate::sandbox::HostProbe, so one staged session judges one reading.

The probe tries, in order, exactly what a session does:

1. network — the session’s own creator (crate::network_namespace): unshare(CLONE_NEWUSER | CLONE_NEWNET), identity maps, lo, the local route, the sockets and the hand-off.
2. mount — in a child that joins that namespace the way every command does (join_session_netns), the private mount namespace a command’s /tmp mapping builds: unshare(CLONE_NEWNS), MS_REC | MS_PRIVATE, a recursive bind over /tmp.
3. sealed root — in a second joining child, the composed root’s nested construction: unshare(CLONE_NEWUSER | CLONE_NEWNS), identity maps, MS_REC | MS_PRIVATE, a tmpfs, pivot_root(2), detaching the old root.
4. private proc — in a third joining child that also enters the session’s PID namespace and forks into it, as a command’s relay does: unshare(CLONE_NEWNS), MS_REC | MS_PRIVATE, and mount -t proc over /proc with the hidepid spellings crate::proc_view mounts with.

The creator the network attempt runs also creates the session’s PID namespace and its holder, so that attempt exercises the PID namespace too; dropping its handles ends the holder.

The mount attempts run inside the probe’s network namespace because no command runs outside one: a command joins its session’s namespaces first, on every tier, and only then builds its mount namespace. A host that cannot create the network namespace attempts none of them.

AppArmor’s unprivileged-userns restriction and the profile confining mur are read with the attempts, and only ever choose the words of a refusal: no decision reads them.

Structs

NamespaceReading

The host’s namespaces as one probe found them: the three attempts, in the order a session makes them, and the two readings a refusal is worded from.

Enums

MountAttempt

What one mount rehearsal did.

MountAttemptError

Why a mount rehearsal produced no namespace.

MountStep

One step of a mount rehearsal, as the child reports it when that step fails.