[adilalperenciftci]

Summary

I traced two grant-transport failures in spawn_sandboxed: concurrent calls reused one PID-only shared-memory name, and the fixed serializer accepted incomplete records while allowing snprintf's required length to exceed its stack buffer. A valid empty grant list was rejected even though it represents a deny-all policy.

This change:

• allocates every transport from a PID plus atomic per-process sequence;
• creates shared-memory objects with O_CREAT | O_EXCL and bounded collision retries;
• keeps transport names call-local and removes owned objects on setup failures;
• shares the creation and serialization helpers between Linux and FreeBSD;
• accepts an empty list as a null-terminated deny-all policy;
• rejects null items, odd lists, line delimiters, category delimiters and records that do not fit the 8 KiB transport;
• adds synchronized concurrency and grant-validation regressions.

Verification

• BEFORE: synchronized launches used the same /aether_sandbox_<pid> object; empty deny-all returned -1; null, multiline and oversized records were accepted.
• AFTER: concurrent launches use distinct objects, deny-all starts the child, and invalid records fail before launch.
• sh tests/integration/sandbox_grant_transport/test_sandbox_grant_transport.sh
• sh tests/integration/sandbox_unique_shm/test_sandbox_unique_shm.sh
• sandbox child signal-safety, clone-fence, fork-grant and preload-lookup integrations
• make check-changelog
• make check-tests
• make test (634 passed)

The optional i386 clone probe skipped because Zig is not installed in the Ubuntu VM.

Signed-off-by: Adil Alperen Çiftci adilalperenciftci@users.noreply.github.com

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[paul-hammant]

Thanks, reviewed and folded into the batch #3456 with your authorship kept on the commit. One change on top: the grant serialiser now denies an entry that would run past its buffer, and ATOMIC_VAR_INIT is dropped (e18798f). This PR will be closed when #3456 merges.

🤖 Generated with Claude Code

[paul-hammant]

Merged as part of #3456 (merge 9364d6b), with your authorship on the commit. Thank you, @adilalperenciftci: this was a real fix, carefully tested, and it's appreciated.

🤖 Generated with Claude Code

[paul-hammant]

A correction to my closing note: #3456 took this PR's earlier revision (ebdb453, the unique shm names). Your later push (ac2a506: aether_sandbox_grants.h with the CR/LF and : injection checks, no silent truncation, and the grant-transport test) arrived after the batch was built, so it isn't in main yet. That's on us, not you. It's a real improvement, and it supersedes the serializer guard we added (e18798f), so we're rebasing your commit onto main now, with you as author, as a follow-up PR. I'll link it here. No need to redo it.

🤖 Generated with Claude Code

[paul-hammant]

Follow-up with your later revision, rebased onto main with you as author: #3466.

🤖 Generated with Claude Code