Function spawn

crates/openshell-supervisor-process/src/bypass_monitor/mod.rs:120–296

Spawn the bypass monitor as a background tokio task. Uses `dmesg --follow` to tail the kernel ring buffer for nftables log entries matching the given namespace. Falls back gracefully if `dmesg` is not available. We use `dmesg` rather than reading `/dev/kmsg` directly because the container runtime's device cgroup policy blocks direct `/dev/kmsg` access even with `CAP_SYSLOG`. The `dmesg` command

(
    namespace_name: String,
    entrypoint_pid: Arc<AtomicU32>,
    denial_tx: Option<mpsc::UnboundedSender<DenialEvent>>,
    activity_tx: Option<ActivitySender>,
)

/// Returns a `JoinHandle` if the monitor was started, or `None` if `dmesg`
/// is not available.
pub fn spawn(
    namespace_name: String,
    entrypoint_pid: Arc<AtomicU32>,
    denial_tx: Option<mpsc::UnboundedSender<DenialEvent>>,
    activity_tx: Option<ActivitySender>,
) -> Option<tokio::task::JoinHandle<()>> {
    use std::io::BufRead;
    use std::process::{Command, Stdio};

    // Verify dmesg is available before spawning the monitor.
    let dmesg_check = Command::new("dmesg")
        .arg("--version")
        .stdout(Stdio::null())
        .stderr(Stdio::null())
        .status();

    if !dmesg_check.is_ok_and(|s| s.success()) {
        let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
            .activity(ActivityId::Other)
            .severity(SeverityId::Low)
            .message(
                "dmesg not available; bypass detection monitor will not run. \
                 Bypass REJECT rules still provide fast-fail behavior.",
            )
            .build();
        ocsf_emit!(event);
        return None;
    }

    let namespace_prefix = format!("openshell:bypass:{namespace_name}:");
    debug!(
        namespace = %namespace_name,
        "Starting bypass detection monitor via dmesg --follow"
    );

    let handle = tokio::task::spawn_blocking(move || {
        // Start dmesg in follow mode to tail new kernel messages.
        let mut child = match Command::new("dmesg")
            .args(["--follow", "--notime"])
            .stdout(Stdio::piped())
            .stderr(Stdio::null())
            .spawn()
        {
            Ok(c) => c,
            Err(e) => {
                let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
                    .activity(ActivityId::Other)
                    .severity(SeverityId::Low)
                    .message(format!(
                        "Failed to start dmesg --follow; bypass monitor will not run: {e}"
                    ))
                    .build();
                ocsf_emit!(event);
                return;
            }
        };

        let Some(stdout) = child.stdout.take() else {