test(ci): add rootless capability regression test on ubuntu-24.04

Add a rootless-caps job to branch-checks.yml that runs the supervisor
capability bounding set and drop_privileges tests as an unprivileged
user on ubuntu-24.04 where AppArmor restricts PR_CAPBSET_DROP.

Update architecture/sandbox.md to describe the degraded rootless mode
where seccomp provides confinement when the bounding set cannot be
cleared.

Signed-off-by: Wayne Sun <gsun@redhat.com>

Author: waynesun09

.github/workflows/branch-checks.yml

@@ -172,6 +172,36 @@ jobs:
       - name: Test
         run: mise run test:python
 
+  rootless-caps:
+    name: Rootless capability tests
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
+        with:
+          toolchain: "1.95.0"
+          cache: false
+
+      - name: Run supervisor capability tests without CAP_SETPCAP
+        run: |
+          sudo useradd -m testuser
+          sudo chmod a+rx /home/runner /home/runner/work /home/runner/work/OpenShell
+          sudo chmod -R a+rX "$GITHUB_WORKSPACE"
+          sudo cp -r /home/runner/.rustup /home/testuser/.rustup
+          sudo chown -R testuser: /home/testuser/.rustup
+          sudo mkdir -p /home/testuser/.cargo
+          sudo cp /home/runner/.cargo/config.toml /home/testuser/.cargo/ 2>/dev/null || true
+          sudo chown -R testuser: /home/testuser/.cargo
+          sudo -u testuser env \
+            PATH="/home/testuser/.cargo/bin:/home/testuser/.rustup/toolchains/1.95.0-x86_64-unknown-linux-gnu/bin:$PATH" \
+            CARGO_HOME="/home/testuser/.cargo" \
+            RUSTUP_HOME="/home/testuser/.rustup" \
+            CARGO_TARGET_DIR="/home/testuser/target" \
+            bash -c "cd $GITHUB_WORKSPACE && cargo test -p openshell-supervisor-process --lib -- capability_bounding drop_privileges"
+
   markdown:
     name: Markdown
     needs: pr_metadata

architecture/sandbox.md

@@ -16,10 +16,14 @@ Each sandbox workload has two trust levels:
 The supervisor keeps enough privilege to manage the sandbox, but the agent child
 loses that privilege before user code runs. On Linux, child setup clears the
 capability bounding set during privilege drop so later execs cannot regain
-container-granted capabilities. This is fail-closed: the supervisor retains
-`CAP_SETPCAP` solely to perform the clear, and spawning the workload or SSH shell
-aborts unless the bounding set ends up empty. A `setpcap` `EPERM` is tolerated
-only when the set is already empty; any other outcome fails the spawn.
+container-granted capabilities. When `CAP_SETPCAP` is available, this is
+fail-closed: the supervisor clears the bounding set and aborts if capabilities
+remain. When `CAP_SETPCAP` is unavailable (rootless Podman with AppArmor
+user-namespace restrictions, or similar environments), the supervisor logs a
+warning, emits an OCSF `DetectionFinding` alert, and continues with the
+bounding set intact. In this degraded mode the child process relies on seccomp
+to block dangerous syscalls; Landlock filesystem restrictions are applied
+independently and may also be active.
 
 ## Startup Flow