Harden sandboxed install phases

[MikeMcQuaid]

• Refuse reads of real user $HOME during builds, we expose a fake one instead
• Keep cask completion generation offline before running it
• Mask denied read paths where the Linux sandbox can enforce them

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR hardens sandboxed install/test phases by preventing access to the real user home directory where supported, using fake HOME directories, and keeping cask completion generation offline.

Changes:

• Adds sandbox APIs for read-deny rules and platform-specific support/masking.
• Applies deny_read_home to formula build/postinstall/test and cask sandbox flows.
• Updates tests for denied read paths, Linux masking, installer sandbox stubs, and cask completion sandbox behavior.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Library/Homebrew/sandbox.rb	Adds read-deny rule helpers and deny_read_home.
Library/Homebrew/extend/os/mac/sandbox.rb	Detects macOS sandbox support for read-deny rules.
Library/Homebrew/extend/os/linux/sandbox.rb	Masks denied read paths in Bubblewrap arguments.
Library/Homebrew/formula.rb	Uses fake HOME for postinstall and threads fake HOME into shared build/test env.
Library/Homebrew/formula_installer.rb	Denies real HOME reads during sandboxed build/postinstall phases.
Library/Homebrew/dev-cmd/test.rb	Denies real HOME reads during sandboxed formula tests.
Library/Homebrew/cask/artifact/abstract_artifact.rb	Adds fake HOME and read-deny/network-deny behavior for cask sandbox commands.
Library/Homebrew/test/sandbox_shared_spec.rb	Tests shared sandbox read-deny rule creation.
Library/Homebrew/test/sandbox_linux_spec.rb	Tests Linux Bubblewrap masking for denied read directories.
Library/Homebrew/test/formula_installer_spec.rb	Updates installer sandbox test doubles for deny_read_home.
Library/Homebrew/test/cask/artifact/generated_completion_spec.rb	Updates cask completion sandbox tests for fake HOME/read-deny/offline ordering.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.