fix(desktop): preserve Linux sandboxing wherever the host allows it

Chromium checks its Linux sandbox before main.js, while package installation probes run as root and miss AppArmor restrictions on desktop users. Choose the launch flags before exec and always install the SUID alternative for native packages. Test published artifacts as an ordinary user with namespaces both denied and allowed; never repair permissions in the smoke harness.

.github/workflows/ci.yml

@@ -178,7 +178,7 @@ jobs:
     name: desktop-tests (ubuntu-latest)
     needs: changes
     if: ${{ !cancelled() && (needs.changes.outputs.full != 'false' || needs.changes.outputs.desktop != 'false') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: read
@@ -201,7 +201,7 @@ jobs:
 
       - name: Install virtual display
         if: ${{ runner.os == 'Linux' }}
-        run: sudo apt-get update && sudo apt-get install -y xvfb xauth
+        run: sudo apt-get update && sudo apt-get install -y xvfb xauth rpm
 
       - name: Install Playwright browser
         if: ${{ runner.os == 'Linux' }}
@@ -226,17 +226,38 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-      - name: Build and smoke unpacked desktop app
+      - name: Build Linux desktop artifacts
         if: ${{ runner.os == 'Linux' }}
-        run: npm run build:desktop -- --publish never --linux --x64 --dir
+        run: npm run build:desktop -- --publish never --linux --x64
         env:
           EP_GH_IGNORE_TIME: true
-          PASEO_DESKTOP_SMOKE: "1"
           PASEO_DESKTOP_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/desktop-smoke
 
+      - name: Smoke installed artifacts with restricted user namespaces
+        if: ${{ runner.os == 'Linux' }}
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1
+          if unshare --user --map-root-user --net true; then
+            echo "Expected the launching user's namespace probe to be denied"
+            exit 1
+          fi
+          sudo dpkg -i packages/desktop/release/*.deb
+          node packages/desktop/e2e/linux-artifact-smoke.js packages/desktop/release disabled
+        env:
+          PASEO_DESKTOP_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/desktop-smoke/restricted
+
+      - name: Smoke sandbox-preserving portable launches
+        if: ${{ runner.os == 'Linux' }}
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          unshare --user --map-root-user --net true
+          node packages/desktop/e2e/linux-artifact-smoke.js packages/desktop/release enabled
+        env:
+          PASEO_DESKTOP_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/desktop-smoke/userns
+
       - name: Upload packaged smoke diagnostics
         uses: actions/upload-artifact@v4
-        if: ${{ failure() && runner.os == 'Linux' }}
+        if: ${{ always() && runner.os == 'Linux' }}
         with:
           name: desktop-packaged-smoke-linux-x64
           path: ${{ runner.temp }}/desktop-smoke

.github/workflows/desktop-release.yml

@@ -218,7 +218,7 @@ jobs:
     permissions:
       contents: write
       packages: read
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v4
@@ -261,7 +261,7 @@ jobs:
           NODE
 
       - name: Install Linux smoke display
-        run: sudo apt-get update && sudo apt-get install -y xvfb xauth
+        run: sudo apt-get update && sudo apt-get install -y xvfb xauth rpm
 
       - name: Build desktop release
         shell: bash
@@ -277,8 +277,28 @@ jobs:
           build_args+=("-c.publish.channel=$RELEASE_CHANNEL")
           npm run build:desktop "${build_args[@]}"
 
+      - name: Smoke installed artifacts with restricted user namespaces
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1
+          if unshare --user --map-root-user --net true; then
+            echo "Expected the launching user's namespace probe to be denied"
+            exit 1
+          fi
+          sudo dpkg -i packages/desktop/release/*.deb
+          node packages/desktop/e2e/linux-artifact-smoke.js packages/desktop/release disabled
+        env:
+          PASEO_DESKTOP_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/desktop-smoke/restricted
+
+      - name: Smoke sandbox-preserving portable launches
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          unshare --user --map-root-user --net true
+          node packages/desktop/e2e/linux-artifact-smoke.js packages/desktop/release enabled
+        env:
+          PASEO_DESKTOP_SMOKE_ARTIFACT_DIR: ${{ runner.temp }}/desktop-smoke/userns
+
       - name: Upload packaged smoke diagnostics
-        if: failure()
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: desktop-smoke-linux-x64