/** Path of the AppArmor knob that gates unprivileged userns on Ubuntu 23.10+. */
export declare const APPARMOR_USERNS_SYSCTL_PATH = "/proc/sys/kernel/apparmor_restrict_unprivileged_userns";
export type UsernsState = 
/** A new user namespace with a uid map can be created — Codex's sandbox works. */
'ok'
/** Unprivileged userns is restricted — Codex's bwrap sandbox cannot start. */
 | 'blocked'
/** Could not determine (non-Linux, or the probe could not run). */
 | 'unknown';
export interface UsernsStatus {
    state: UsernsState;
    /** One-line human reason, present when `blocked` or `unknown`. */
    reason?: string;
}
/** The raw signals the pure interpreter reasons over. */
export interface UsernsInputs {
    platform: NodeJS.Platform;
    /**
     * Contents of {@link APPARMOR_USERNS_SYSCTL_PATH} trimmed, or null when the
     * file is absent (older kernels / no AppArmor userns mediation).
     */
    apparmorRestrict: string | null;
    /**
     * Result of actually attempting to create a user namespace with a uid map:
     *   - 'ok'      → the probe created the namespace and mapped root.
     *   - 'denied'  → the kernel refused the uid_map write (the restricted case).
     *   - 'no-tool' → the probe binary (`unshare`) was missing or failed to spawn.
     */
    unshareProbe: 'ok' | 'denied' | 'no-tool';
}
/**
 * Decide userns availability from raw signals. Pure — no I/O.
 *
 * The definitive signal is the actual probe: if we successfully created a userns
 * and wrote a uid map, the sandbox works regardless of the sysctl (an AppArmor
 * profile may grant a specific binary `userns` even while the global knob is 1).
 * A denied probe is a hard `blocked`. When the probe tool is missing we fall back
 * to the sysctl: `1` → `blocked`, `0`/absent → `unknown` (we could not prove it,
 * and refuse to claim `ok` we did not observe).
 */
export declare function interpretUsernsInputs(inputs: UsernsInputs): UsernsStatus;
/** Read the AppArmor userns sysctl, or null when the file is absent. */
export declare function readApparmorRestrict(sysctlPath?: string): string | null;
/**
 * Actually try to create a user namespace and map root inside it — the same
 * operation bwrap performs (`unshare --user --map-root-user`). This is the ground
 * truth: it observes exactly what the kernel/AppArmor policy permits for *this*
 * process, rather than inferring from the sysctl alone.
 */
export declare function probeUnshare(): 'ok' | 'denied' | 'no-tool';
/**
 * Resolve whether an unprivileged user namespace can be created on this host,
 * cached for the process (the answer is a stable property of the box). Non-Linux
 * short-circuits to `ok` without spawning anything.
 */
export declare function probeUnprivilegedUserns(platform?: NodeJS.Platform): UsernsStatus;
/** Test-only: drop the process cache so a test can re-probe. */
export declare function resetUsernsCacheForTests(): void;
