[ML] Add Sandbox2 security integration for PyTorch inference

.buildkite/scripts/steps/build.sh

@@ -75,8 +75,10 @@ if [[ "$HARDWARE_ARCH" = aarch64 && -z "${CPP_CROSS_COMPILE:-}" && "$(uname)" =
     docker run --rm --workdir=/ml-cpp $TEMP_TAG bash -c '
         {
             find cmake-build-docker/test -name "ml_test_*" -type f -executable 2>/dev/null
-            find cmake-build-docker/lib -name "*.so" 2>/dev/null
-            find build/distribution -name "*.so" -not -path "*.debug*" 2>/dev/null
+            find cmake-build-docker/lib \( -name "*.so" -o -name "*.so.*" \) 2>/dev/null
+            find build/distribution \( -name "*.so" -o -name "*.so.*" \) -not -path "*.debug*" 2>/dev/null
+            # Sandbox2 spawn tests need the installed pytorch_inference binary.
+            find build/distribution -type f -path "*/bin/pytorch_inference" 2>/dev/null
         } | sort -u > /tmp/bundle-files.txt
         echo "Files in bundle: $(wc -l < /tmp/bundle-files.txt)" >&2
         tar czf - -T /tmp/bundle-files.txt
@@ -109,6 +111,8 @@ elif [[ "$(uname)" = "Linux" ]]; then
         find ${BUILD_DIR}/lib -name "*.so" -o -name "*.dylib" 2>/dev/null
         if [ -d "build/distribution" ]; then
             find build/distribution -type f \( -name "*.so" -o -name "*.dylib" \) -not -path "*.dSYM*" 2>/dev/null
+            # Sandbox2 spawn tests need the installed pytorch_inference binary.
+            find build/distribution -type f -path "*/bin/pytorch_inference" 2>/dev/null
         fi
     } | sort -u > /tmp/test-bundle-files.txt
 
@@ -151,6 +155,8 @@ else
         find ${BUILD_DIR}/lib -name "*.so" -o -name "*.dylib" 2>/dev/null
         if [ -d "build/distribution" ]; then
             find build/distribution -type f \( -name "*.so" -o -name "*.dylib" \) -not -path "*.dSYM*" 2>/dev/null
+            # Sandbox2 spawn tests need the installed pytorch_inference binary.
+            find build/distribution -type f -path "*/bin/pytorch_inference" 2>/dev/null
         fi
     } | sort -u > /tmp/test-bundle-files.txt
 

.buildkite/scripts/steps/run_tests.sh

@@ -61,6 +61,7 @@ if [[ "$HARDWARE_ARCH" = aarch64 && -z "${CPP_CROSS_COMPILE:-}" && "$(uname)" =
         -v "$(pwd)/set_env.sh:/ml-cpp/set_env.sh:ro" \
         -v "$(pwd)/gradle.properties:/ml-cpp/gradle.properties:ro" \
         -e BOOST_TEST_OUTPUT_FORMAT_FLAGS="${BOOST_TEST_OUTPUT_FORMAT_FLAGS:-}" \
+        -e ML_SANDBOX2_EXPECT=fail_closed \
         ${TEST_TIMEOUT:+-e TEST_TIMEOUT="${TEST_TIMEOUT}"} \
         -w /ml-cpp \
         $BASE_IMAGE bash -c '
@@ -82,6 +83,30 @@ if [[ "$HARDWARE_ARCH" = aarch64 && -z "${CPP_CROSS_COMPILE:-}" && "$(uname)" =
     # kernel, so the kernel's seccomp filters are exercised without needing
     # a separate outside-Docker run.
 
+    # The 'enforced' Sandbox2 path requires unshare(CLONE_NEWUSER) + mount(/proc).
+    # SYS_ADMIN + unconfined seccomp/apparmor is still not enough on aarch64 CI
+    # agents (probe: "user namespaces are unavailable"). Nested Docker needs a
+    # full privileged container to create user namespaces. Stay inside the SAME
+    # build image so the binary always runs against the toolchain it was compiled
+    # with (GCC13/Boost 1.86) — no host-side LD_LIBRARY_PATH bundling.
+    if [[ $TEST_OUTCOME -eq 0 ]]; then
+        echo "--- Re-running sandbox unit tests (Docker, enforced)"
+        docker run --rm \
+            --privileged \
+            -v "$(pwd)/${BUILD_DIR}:/ml-cpp/${BUILD_DIR}" \
+            -v "$(pwd)/build:/ml-cpp/build" \
+            -e ML_SANDBOX2_EXPECT=enforced \
+            -w /ml-cpp \
+            $BASE_IMAGE bash -c '
+                LIB_DIRS=$(find /ml-cpp/cmake-build-docker/lib /ml-cpp/build/distribution \
+                    -name "*.so" -exec dirname {} \; 2>/dev/null | sort -u | tr "\n" ":")
+                export LD_LIBRARY_PATH="${LIB_DIRS}/usr/local/gcc133/lib64:/usr/local/gcc133/lib"
+                chmod -R +x cmake-build-docker/test/lib/sandbox/unittest 2>/dev/null
+                cd cmake-build-docker/test/lib/sandbox/unittest
+                ./ml_test_sandbox
+            ' || TEST_OUTCOME=$?
+    fi
+
 else
     # --- Linux x86_64 / macOS: run tests directly ---
     . ./set_env.sh
@@ -98,6 +123,15 @@ else
         export DYLD_LIBRARY_PATH="${LIB_DIRS}${DYLD_LIBRARY_PATH:+:$DYLD_LIBRARY_PATH}"
     fi
 
+    # Linux x86_64 PR agents are Buildkite k8s pods: user namespaces often work
+    # but Sandbox2's mount("", "/proc", "proc", ...) returns EPERM. The probe in
+    # CSandboxedProcessSpawnerTest_Linux requires that mount, so expect fail_closed.
+    # aarch64 enforced sandbox re-run above uses a privileged container.
+    # macOS has no CSandboxedProcessSpawnerTest_Linux.cc.
+    if [[ "$(uname)" = "Linux" ]]; then
+        export ML_SANDBOX2_EXPECT=fail_closed
+    fi
+
     echo "--- Running tests"
     cmake \
         -DSOURCE_DIR="$(pwd)" \