Fail when `--experimental_use_hermetic_linux_sandbox` is set but `linux-sandbox` is unsupported (#32164) ### Description On Linux, `SandboxModule` now fails the command if `--experimental_use_hermetic_linux_sandbox` is set and `linux-sandbox` does not pass its support check. The error includes the reason the check failed, which now carries the `linux-sandbox` stderr instead of discarding it. ### Motivation Fixes #32161. When the `linux-sandbox` check fails (for example, without user namespaces), `sandboxed` resolves to `processwrapper-sandbox` and the hermetic flag is silently ignored. Actions then see the host filesystem and the build still succeeds. We hit this as a build tool loading the host's `libstdc++` instead of the one we provide. This mirrors `--experimental_use_windows_sandbox=yes`, which already fails when `windows-sandbox` is unavailable. A machine that sets the flag but cannot run `linux-sandbox` will now fail instead of silently degrading. Those users can drop the flag. ### Build API Changes No ### Checklist - [x] I have added tests for the new use cases (if any). - [x] I have updated the documentation (if applicable). ### Release Notes RELNOTES: `--experimental_use_hermetic_linux_sandbox` now fails the build on Linux when `linux-sandbox` is not supported, instead of silently falling back to `processwrapper-sandbox`; making it consistent with experimental_use_windows_sandbox. Closes #32164 COPYBARA_INTEGRATE_REVIEW=https://github.com/bazelbuild/bazel/pull/32164 from Spikhalskiy:hermetic-sandbox-fail-closed 4c9feb3589893f55c3632f26ccd47bb3eb254bc1 PiperOrigin-RevId: 1008942158 Change-Id: I73343a045ba963157b72f4854e692bccfaeb3463
{Fast, Correct} - Choose two
Build and test software of any size, quickly and reliably.
Speed up your builds and tests: Bazel rebuilds only what is necessary. With advanced local and distributed caching, optimized dependency analysis and parallel execution, you get fast and incremental builds.
One tool, multiple languages: Build and test Java, C++, Android, iOS, Go, and a wide variety of other language platforms. Bazel runs on Windows, macOS, and Linux.
Scalable: Bazel helps you scale your organization, codebase, and continuous integration solution. It handles codebases of any size, in multiple repositories or a huge monorepo.
Extensible to your needs: Easily add support for new languages and platforms with Bazel's familiar extension language. Share and re-use language rules written by the growing Bazel community.
To report a security issue, please email security@bazel.build with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue. Our vulnerability management team will respond within 3 working days of your email. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.
See CONTRIBUTING.md
