[adilalperenciftci]

Summary

I reproduced the preload layer silently becoming inactive when an explicitly configured shared-memory or grant-file source could not be opened. The intercepted process then ran without grant checks even though containment had been requested.

This change:

• distinguishes "no source configured" from "configured source failed";
• keeps interception active with zero grants when every configured source is missing, unreadable, malformed, or oversized;
• preserves grant-file fallback when a shared-memory source is unavailable;
• bounds both source forms to 8 KiB and refuses truncated file input before parsing;
• removes the parser's one-byte boundary read when a buffer has no NUL terminator.

Verification

• BEFORE: missing SHM and missing grant-file cases both read the protected file and exited zero.
• AFTER: missing SHM, missing file, and oversized file cases fail closed.
• Valid grant-file fallback after a missing SHM source: passed.
• Preload with no configured source remains inert: passed.
• Sandbox preload lookup, child signal-safety, and fork-grant integrations: passed.
• make check-tests: passed.
• make test: 634 passed, 0 failed on Ubuntu VM.
• make check-changelog: passed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[paul-hammant]

Thanks, reviewed and folded into the batch #3456 with your authorship kept on the commit. This PR will be closed when #3456 merges.

🤖 Generated with Claude Code

[paul-hammant]

Merged as part of #3456 (merge 9364d6b), with your authorship on the commit. Thank you, @adilalperenciftci: this was a real fix, carefully tested, and it's appreciated.

🤖 Generated with Claude Code