refactor(linux): drop sandbox-availability probe; --no-sandbox unconditionally

Revert Linux sandbox handling to the minimal change needed for CEF 147.
The old code set no_sandbox=1 in CefSettings, which in 147 makes
BasicStartupComplete() append --no-sandbox before the Mojo bootstrap fd
(GlobalDescriptors key 7) is registered, crashing every subprocess with
"Failed global descriptor lookup: 7". Linux now passes the --no-sandbox
command-line switch unconditionally instead -- the same "sandbox off"
behavior cefpython has always had, via the mechanism 147 requires.

Removes the runtime sandbox-availability probe (sandbox_linux.cpp/.h/
.pxd, the cimport, the window_utils_linux.pyx conditional and its
Knowledge-Base section). Keeping the sandbox enabled where the system
supports it belongs in a separate change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: linesight

docs/Knowledge-Base.md

@@ -18,7 +18,6 @@ Table of contents:
 * [Windows XP support](#windows-xp-support)
 * [Mac 32-bit support](#mac-32-bit-support)
 * [Security](#security)
-  * [Linux: the Chromium sandbox](#linux-the-chromium-sandbox)
 
 
 ## Notifications about new releases / commits
@@ -376,60 +375,3 @@ A quote by Marshall Greenblatt:
 Reference: [Question on browser security](http://magpcss.org/ceforum/viewtopic.php?f=10&t=10222)
 on the CEF Forum.
 
-
-### Linux: the Chromium sandbox
-
-cefpython keeps the Chromium sandbox **enabled** whenever the system can
-support it, and passes `--no-sandbox` only as a fallback when no usable
-sandbox is detected (`_linux_apply_initialize_defaults` /
-`_linux_sandbox_available` in `src/window_utils_linux.pyx`).
-
-At `cef.Initialize()` cefpython decides as follows:
-1. If `CHROME_DEVEL_SANDBOX` points to an existing SUID-root helper, the
-   sandbox is kept.
-2. Else, if a kernel switch disables unprivileged user namespaces
-   (`kernel.apparmor_restrict_unprivileged_userns=1` — the default on
-   Ubuntu 23.10+/Debian 12+; `kernel.unprivileged_userns_clone=0`;
-   `user.max_user_namespaces=0`), `--no-sandbox` is added.
-3. Else a real `unshare(CLONE_NEWUSER)` probe is run in a forked child (this
-   also catches container seccomp policies, e.g. Docker's default, that block
-   the syscall without setting any of the switches above). If it fails,
-   `--no-sandbox` is added.
-
-When cefpython falls back to `--no-sandbox` it emits a `UserWarning` so the
-security downgrade is visible; renderer processes then run unsandboxed
-(seccomp-bpf still applies).
-
-Why not just ship the sandbox: a pip wheel cannot install a
-chown-root + chmod-4755 `chrome-sandbox` helper (pip runs as the user and has
-no postinst hook), so on systems where unprivileged user namespaces are
-restricted the only out-of-box option is `--no-sandbox`.
-
-**Forcing the sandbox off.** Pass `switches={"no-sandbox": ""}` to
-`cef.Initialize()`; an explicit value is respected and the auto-detection is
-skipped.
-
-**Enabling the sandbox on a restricted system.** If your app loads untrusted
-web content on a distro where unprivileged user namespaces are disabled,
-install the SUID-root helper and point `CHROME_DEVEL_SANDBOX` at it — no
-source patch or extra switches needed, cefpython will then keep the sandbox:
-
-```bash
-sudo cp /path/to/cef_binary_<ver>_linux64/Release/chrome-sandbox \
-        /opt/cef/chrome-sandbox
-sudo chown root:root /opt/cef/chrome-sandbox
-sudo chmod 4755 /opt/cef/chrome-sandbox
-```
-
-```python
-import os
-os.environ["CHROME_DEVEL_SANDBOX"] = "/opt/cef/chrome-sandbox"
-```
-
-Verify Chromium subprocesses launched under the sandbox (no `--no-sandbox`
-in their argv, no `FATAL: No usable sandbox!`):
-
-```bash
-ps -Af | grep "type=gpu" | grep -v "no-sandbox"
-```
-

src/cefpython.pyx

@@ -225,7 +225,6 @@ from task cimport *
 
 IF UNAME_SYSNAME == "Linux":
     cimport x11
-    cimport sandbox_linux
 
 from cef_string cimport *
 cdef extern from *:
@@ -618,15 +617,12 @@ def Initialize(applicationSettings=None, commandLineSwitches=None, **kwargs):
 
     cdef CefSettings cefApplicationSettings
     IF UNAME_SYSNAME == "Linux":
-        # On Linux, leave no_sandbox=0 so Chrome's startup code registers the
-        # Mojo IPC bootstrap fd (GlobalDescriptors key 7) for every subprocess.
-        # Setting no_sandbox=1 would cause BasicStartupComplete() to append
-        # --no-sandbox before fd registration, causing all subprocesses to crash
-        # with "Failed global descriptor lookup: 7". Sandbox behaviour is instead
-        # controlled by the --no-sandbox command-line switch, which
-        # _linux_apply_initialize_defaults() adds only when no usable sandbox is
-        # detected (see the native LinuxSandboxAvailable() in
-        # src/client_handler/sandbox_linux.cpp).
+        # On Linux, leave no_sandbox=0 here. Setting no_sandbox=1 would cause
+        # BasicStartupComplete() to append --no-sandbox before Chrome's startup
+        # code registers the Mojo IPC bootstrap fd (GlobalDescriptors key 7),
+        # crashing every subprocess with "Failed global descriptor lookup: 7".
+        # The sandbox is instead disabled via the --no-sandbox command-line
+        # switch added in _linux_apply_initialize_defaults().
         pass
     ELSE:
         # On Windows/macOS the sandbox helper binary is not shipped with

src/client_handler/sandbox_linux.cpp

@@ -150,47 +150,10 @@ def _linux_apply_initialize_defaults(app_settings, cmd_switches):
     # False — no delete_event would be dispatched on a windowed popup.
     app_settings.setdefault("windowless_rendering_enabled", True)
 
-    # Chromium's Linux sandbox — keep it when possible, disable only if unusable.
-    #
-    # CEF Linux builds default sandbox-ON and refuse to start unless either a
-    # SUID-root chrome-sandbox helper is installed or --no-sandbox is passed.
-    # A pip wheel cannot install a chown-root + chmod-4755 helper, so cefpython
-    # relies on Chromium's unprivileged-user-namespace sandbox instead.  That
-    # path works on most systems, but modern distros (Ubuntu 23.10+, Debian 12+)
-    # set kernel.apparmor_restrict_unprivileged_userns=1 by default, and
-    # containers often block the unshare() syscall via seccomp — in those cases
-    # Chromium aborts with "FATAL: No usable sandbox!" unless --no-sandbox is
-    # passed.
-    #
-    # So probe for a usable sandbox and only fall back to --no-sandbox when none
-    # is available, keeping renderers confined wherever the namespace sandbox
-    # works.  Historically cefpython passed --no-sandbox unconditionally, which
-    # silently disabled the sandbox even on capable systems.  A user can force
-    # the sandbox off by passing switches={"no-sandbox": ""} explicitly, or
-    # enable it on a restricted system by installing the SUID helper and setting
-    # CHROME_DEVEL_SANDBOX (see docs/Knowledge-Base.md "Linux: enabling the
-    # Chromium sandbox").
+    # Chromium's Linux sandbox.  CEF Linux builds default sandbox-ON and refuse
+    # to start unless a SUID-root chrome-sandbox helper is installed or
+    # --no-sandbox is passed.  A pip wheel cannot install a chown-root helper,
+    # so cefpython disables the sandbox on Linux, as it always has.  Added only
+    # when the caller has not set the switch explicitly.
     if "no-sandbox" not in cmd_switches:
-        # Some switches turn off the zygote / multiprocess model, which
-        # Chromium requires for the sandbox — it refuses to start otherwise
-        # with "Zygote cannot be disabled if sandbox is enabled".  When the
-        # caller has opted into any of these, pair them with --no-sandbox.
-        _needs_no_sandbox = any(
-            _sw in cmd_switches
-            for _sw in ("no-zygote", "disable-zygote", "single-process"))
-        if _needs_no_sandbox:
-            cmd_switches["no-sandbox"] = ""
-        elif not sandbox_linux.LinuxSandboxAvailable():
-            cmd_switches["no-sandbox"] = ""
-            import warnings
-            warnings.warn(
-                "cefpython: Chromium sandbox disabled (--no-sandbox). No usable "
-                "sandbox was detected — unprivileged user namespaces appear to "
-                "be restricted (e.g. kernel.apparmor_restrict_unprivileged_userns"
-                "=1 on Ubuntu 23.10+/Debian 12+, or a container seccomp policy) "
-                "and no CHROME_DEVEL_SANDBOX helper is configured. Renderer "
-                "processes will run without the sandbox. See "
-                "docs/Knowledge-Base.md 'Linux: enabling the Chromium sandbox' "
-                "to enable it.",
-                stacklevel=2,
-            )
+        cmd_switches["no-sandbox"] = ""