[EmilienM]

Summary

Every non-test unsafe block in openshell-sandbox now carries a // SAFETY: comment stating its invariant, and clippy::undocumented_unsafe_blocks is enabled at warn level in the crate roots, so the CI clippy lanes fail the build on new undocumented blocks. The lint fires 89 times on main and zero times after this change.

reset_child_signal_dispositions gains a # Safety section. The vsock control stream reinterpreted as a UnixStream is documented in place: which operations it relies on being family-agnostic, which AF_UNIX members must never be called on it, and where the dial side does the same reinterpretation.

Related Issue

Closes #5188

Note: the issue is still awaiting state:accepted, so the PR Issue Acceptance job stays red until a maintainer accepts it.

Changes

• 20 // SAFETY: comments on non-test unsafe blocks across boundary_server.rs (7), main.rs (6), network_broker.rs (3), process.rs (2), sandbox/linux/seccomp.rs (1), linux/seccomp_notify.rs (1)
• # Safety section on reset_child_signal_dispositions (forked pre-exec child only)
• #![warn(clippy::undocumented_unsafe_blocks)] in lib.rs, main.rs, and bin/seccomp-perf.rs, each with cfg_attr(test, allow) for the test-only blocks (after rebasing on fix(sandbox): zero-initialize sigset_t before assume_init #5194's signal-mask tests, main.rs needs the exemption too: their SAFETY comments sit above the assert_*! line, where the line-anchored lint can't see them)
• 9 hoists/nested-if restructures and 2 statement reorderings so each comment sits on the line directly above its block (the lint is line-anchored); short-circuits and the errno adjacency the probe helpers rely on are preserved
• 4 new tests pinning those properties: two run the self-protection probes against seccomp filters (one lets the FIOSETOWN ioctl through to the kernel, so a probe reading another syscall's errno fails), two cover the F_SETFL error arms in connect_exact

This is not a comment-only change: the movements are mechanical but real, and the tests exist because the existing suites are end-state based and cannot catch a wrong hoist.

Left as follow-ups on purpose:

• multiple_unsafe_ops_per_block stays off: it is restriction-group and needs block splits at 7 production sites, one owned by bug: workload pre_exec hooks compile the seccomp filter and log after fork #5180
• the ~70 test-only blocks stay exempt through cfg_attr(test, allow); documenting them would let the allow drop
• a family-abstracted control-stream type would make the vsock constraint structural instead of comment-enforced
• clippy::missing_safety_doc never fires on private bin fns, so the # Safety half of the acceptance criteria has no enforcement after this PR

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass: cargo clippy -p openshell-sandbox --all-targets (with and without --features perf-harness) with -D warnings, the workspace clippy lanes, and cargo fmt --check
• Unit tests added/updated: the 4 tests above; cargo test -p openshell-sandbox green, plus the full workspace suite, server tests, and nextest groups locally
• E2E tests added/updated: not applicable, no behavior change

The musl cross-check could not run locally (no musl C cross-compiler on this host); the only change near cfg(musl) code is a comment move.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[mrunalp]

/ok to test 16d0012

[shiju-nv]

Could we run these probes in a fresh executable process using the existing current_exe() and --exact pattern?

Both fork_capture helpers run allocating Rust code after a raw fork, including filter preparation and to_vec(). This violates nix::fork's safety contract when the parent has multiple threads. Calling _exit afterward avoids inherited destructors, but doesn't make the preceding allocations safe.

If the child stalls on an inherited lock, the parent waits indefinitely in the pipe read.

[EmilienM]

Done in 0d0372a: fork_capture is gone. Both probe tests now re-exec the test binary (current_exe + --exact + an env-var gate, the same pattern as managed_children), so the rlimit and seccomp changes land in a fresh process and no allocating code runs in a fork child. The parent also requires the child output to show it matched exactly one test, so a wrong --exact name cannot pass vacuously.

[FrostGod]

/ok to test 32c1957