Reject an unenforceable allowLocalNetwork deny on value, not on presence

allowLocalNetwork=false under a shared namespace is refused at 0.8 because
Bubblewrap cannot deliver the deny. That refusal was gated on a parse-time
allow_local_network_specified flag, so it fired only for callers who wrote
the field. false is the schema default *and* a deny, so an omitted field is
still a request for inbound denial: a bare defaultPolicy='allow' ran with
the deny silently unenforced. Default-deny is the contract, and a backend
that cannot honor a restriction refuses it rather than choosing
default-allow on the caller's behalf.

IsolationSession already takes the strict reading of this exact field:
validate_provision_network_policy requires allow_local_network by value and
refuses an absent policy as "a restriction the backend cannot honor". The
guard is now dropped so Bubblewrap agrees, and the flag it existed for goes
with it -- that guard was its only production consumer, so models.rs and
network_parser.rs leave this change with no net diff.

The rejection stays actionable: a shared namespace is still reachable by
acknowledging the exposure with allowLocalNetwork=true, which the error text
now names. No existing config changes behavior -- both shared-namespace
corpus configs set the field explicitly, and every other 0.8 Bubblewrap
config resolves to a private namespace via a proxy or host rules.

Coverage: the guard had none. Deleting it outright left all 202 tests
passing, because the one test that looked like it covered this used
defaultPolicy='block', whose private namespace short-circuits the mode arm.
Two unit tests now pin the omitted and acknowledged cases (204 total; a
reintroduced guard fails three), and two e2e configs pin them end to end,
the acknowledged one asserting the sandbox really is in the host netns so
"reject the deny" cannot be satisfied by refusing every shared-namespace
request.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ae9db9df-6439-46c3-9cb4-fd70e7cc43a3

Author: SohamDas2021

docs/bwrap-support/bubblewrap-backend.md

@@ -328,6 +328,14 @@ failing silently. Windows (AppContainer's `privateNetworkClientServer`
 capability) and macOS (Seatbelt's `(allow network-inbound (local ip))`)
 enforce the field at the syscall level; this divergence is Linux-specific.
 
+Row 2 is keyed on the value, not on whether the caller wrote the field.
+`false` is the schema's default *and* a deny, so an omitted `allowLocalNetwork`
+is still a request for inbound denial and is rejected the same way: a bare
+`defaultPolicy: "allow"` does not silently opt out of the deny it inherits.
+Callers who want the shared namespace acknowledge the exposure with
+`allowLocalNetwork: true` (row 4), the same acknowledgment IsolationSession
+requires for this field.
+
 ### Process Settings
 
 Standard `process` fields work as expected:

src/backends/bubblewrap/common/src/bwrap_command.rs

@@ -240,7 +240,8 @@ pub const BWRAP_LOCAL_NETWORK_SHARED_NS: &str =
      sandbox shares the host network namespace (defaultPolicy='allow'). \
      The sandboxed process can still bind, listen and accept on host-local addresses. For \
      an unreachable sandbox use defaultPolicy='block' with no host rules and no proxy, \
-     which applies --unshare-net.";
+     which applies --unshare-net; to keep the shared namespace, acknowledge the exposure \
+     with allowLocalNetwork=true.";
 
 /// Rejection text for `allowLocalNetwork=true` under a private namespace.
 pub const BWRAP_LOCAL_NETWORK_PRIVATE_NS: &str =
@@ -307,17 +308,15 @@ pub fn external_proxy_host_rules_rejection(request: &ExecutionRequest) -> Option
 /// `builtinTestServer` has no address until the proxy starts, which is after
 /// validation.
 ///
-/// An unset `allowLocalNetwork` is never rejected. The field defaults to
-/// `false`, so rejecting on the value alone would fail every 0.8 request that
-/// shares the host namespace without asking for inbound policy at all. The
-/// warning path keeps the looser check: it only logs.
+/// Rejects on the value, not on whether the caller wrote the field. `false` is
+/// the schema default *and* a deny, so an omitted `allowLocalNetwork` still
+/// asks for inbound denial. Callers wanting the shared namespace acknowledge
+/// the exposure with `allowLocalNetwork=true`. The warning path keeps the
+/// looser check: it only logs.
 pub fn local_network_rejection(request: &ExecutionRequest) -> Option<&'static str> {
     if !rejects_unhonorable_network(request) {
         return None;
     }
-    if !request.policy.allow_local_network && !request.policy.allow_local_network_specified {
-        return None;
-    }
     let mode =
         ResolvedNetworkMode::from_request(request, request.policy.network_proxy.is_enabled());
     local_network_diagnostic_for_mode(request, mode)
@@ -909,13 +908,36 @@ mod tests {
         let mut r = base_request();
         r.schema_version = "0.8.0-alpha".into();
         r.policy.default_network_policy = NetworkPolicy::Allow;
-        r.policy.allow_local_network_specified = true;
         let msg = local_network_rejection(&r).expect("shared netns cannot honor the deny");
         assert!(msg.contains("allowLocalNetwork=false"));
         // The text is reused verbatim as an error, so it must carry no severity.
         assert!(!msg.contains("WARNING"));
     }
 
+    #[test]
+    fn an_omitted_local_network_is_rejected_like_an_explicit_deny_at_0_8() {
+        // `false` is the schema default *and* a deny, so silence still asks for
+        // inbound denial.
+        let mut r = base_request();
+        r.schema_version = "0.8.0-alpha".into();
+        r.policy.default_network_policy = NetworkPolicy::Allow;
+        assert!(!r.policy.allow_local_network, "default is the deny posture");
+        let msg = local_network_rejection(&r).expect("an omitted deny is still a deny");
+        assert!(msg.contains("allowLocalNetwork=false"));
+        // Actionable only if it names the acknowledgment.
+        assert!(msg.contains("allowLocalNetwork=true"));
+    }
+
+    #[test]
+    fn acknowledged_local_network_exposure_is_accepted_at_0_8() {
+        // The escape hatch from the rejection above.
+        let mut r = base_request();
+        r.schema_version = "0.8.0-alpha".into();
+        r.policy.default_network_policy = NetworkPolicy::Allow;
+        r.policy.allow_local_network = true;
+        assert!(local_network_rejection(&r).is_none());
+    }
+
     #[test]
     fn honored_local_network_is_not_rejected_at_0_8() {
         // block + no host rules + no proxy is a private netns, which satisfies

src/backends/bubblewrap/common/src/bwrap_runner.rs

@@ -1260,7 +1260,6 @@ mod tests {
         let mut req = base_request();
         req.schema_version = "0.8.0-alpha".into();
         req.policy.default_network_policy = wxc_common::models::NetworkPolicy::Allow;
-        req.policy.allow_local_network_specified = true;
 
         let err = BubblewrapScriptRunner::new().validate(&req).unwrap_err();
         assert!(

src/core/wxc_common/src/models.rs

@@ -703,15 +703,6 @@ pub struct ContainerPolicy {
     /// and accept incoming connections. Independent of `default_network_policy`
     /// (which governs outbound traffic).
     pub allow_local_network: bool,
-    /// Whether the caller supplied `network.allowLocalNetwork` on the wire.
-    ///
-    /// Field-level twin of `network_specified`, needed because this field
-    /// defaults to `false`, which is also the value a caller may set
-    /// explicitly. Backends that reject an unenforceable `false` must not
-    /// reject a request that never asked for one. Parse-derived, never on the
-    /// wire.
-    #[serde(skip)]
-    pub allow_local_network_specified: bool,
     pub allowed_hosts: Vec<String>,
     pub blocked_hosts: Vec<String>,
     /// Outbound CIDR, protocol, and port policy.

src/core/wxc_common/src/network_parser.rs

@@ -244,7 +244,6 @@ fn apply_legacy_network(
     }
     if let Some(allow) = network.allow_local_network {
         policy.allow_local_network = allow;
-        policy.allow_local_network_specified = true;
     }
     if let Some(hosts) = network.allowed_hosts {
         policy.allowed_hosts = hosts;

tests/configs/bubblewrap_network_localnet_acknowledged.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.8.0-alpha",
+  "containerId": "CLI-Bubblewrap-LocalNet-Acknowledged",
+  "containment": "bubblewrap",
+  "process": {
+    "commandLine": "bash -c 'set -u; echo SANDBOX_NETNS=$(readlink /proc/self/ns/net); echo LOCALNET_ACK_OK'"
+  },
+  "network": {
+    "defaultPolicy": "allow",
+    "allowLocalNetwork": true
+  }
+}

tests/configs/bubblewrap_network_localnet_omitted_rejected.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.8.0-alpha",
+  "containerId": "CLI-Bubblewrap-LocalNet-Omitted-Rejected",
+  "containment": "bubblewrap",
+  "process": {
+    "commandLine": "echo LOCALNET_SHOULD_NOT_RUN"
+  },
+  "network": {
+    "defaultPolicy": "allow"
+  }
+}

tests/scripts/run_bwrap_localnet_test.sh

@@ -96,6 +96,39 @@ assert_rejected "allowLocalNetwork=true under a private namespace" \
     "bubblewrap_network_localnet_private_rejected.json" \
     "is confined to the sandbox's own network namespace"
 
+# The same rejection with the field omitted. `false` is the schema default *and*
+# a deny, so silence still asks for inbound denial. Separate from the explicit
+# case because a presence check would pass that one and fail this one.
+assert_rejected "an omitted allowLocalNetwork on a shared namespace" \
+    "bubblewrap_network_localnet_omitted_rejected.json" \
+    "is not enforced while the sandbox shares the host network namespace"
+
+# The escape hatch from both cases above. Pinned because "reject the deny" is
+# also satisfiable by rejecting every shared-namespace request, which would
+# leave these callers with no expressible policy.
+echo "Running Bubblewrap localnet test: acknowledged exposure is accepted..."
+ACK_RC=0
+ACK_OUT=$("$LXC_EXEC" --experimental --allow-testing-features \
+    "$REPO_DIR/tests/configs/bubblewrap_network_localnet_acknowledged.json" 2>&1) \
+    || ACK_RC=$?
+if [ "$ACK_RC" != 0 ]; then
+    echo "$ACK_OUT"
+    echo "FAIL: acknowledged localnet (exited $ACK_RC; the acknowledgment is not honored)"
+    exit 1
+fi
+if ! grep -q LOCALNET_ACK_OK <<<"$ACK_OUT"; then
+    echo "$ACK_OUT"
+    echo "FAIL: acknowledged localnet (succeeded without running the workload)"
+    exit 1
+fi
+ACK_NETNS="$(sed -n 's/^SANDBOX_NETNS=//p' <<<"$ACK_OUT" | tail -n 1)"
+if [ "$ACK_NETNS" != "$HOST_NETNS" ]; then
+    echo "$ACK_OUT"
+    echo "FAIL: acknowledged localnet (expected the host netns $HOST_NETNS, got $ACK_NETNS)"
+    exit 1
+fi
+echo "PASS: acknowledged exposure is accepted"
+
 # The pre-0.8 twin of the first case. GHCP consumes Bubblewrap proxy mode on
 # 0.6/0.7, so the rejection above must be invisible there.
 #