Scope analysis loggers to the firmware process subtree

[lacraig2]

Problem

Per-process analysis loggers (shell coverage, syscalls, read/write, exec, binds, …) capture every process from boot — including Penguin's own infrastructure: the boot/init machinery and the backgrounded vpnguin/console/guesthopper helpers that run for the entire guest lifetime. The boundary we want is process attribution (the firmware-under-analysis subtree), not a temporal cutoff — a readiness gate can't exclude vpnguin, which runs the whole time.

bb_cov already hinted at this with a fragile, shell-only filename.startswith("/igloo/") filter; this replaces it with one principled mechanism covering all loggers.

Mechanism: inherited UTS-namespace marker, anchored on the initial namespace

init.sh runs the real guest init in a fresh UTS namespace at handoff (unshare -u, with a CONFIG_UTS_NS fallback so boot can't break). The firmware subtree inherits that namespace across fork/exec, so it lives outside the kernel's initial namespace while all Penguin infrastructure stays in it (including call_usermodehelper spawns). The igloo_driver gates syscall/exec/bind hypercall emission on current's namespace, which auto-scopes every logger fed by those hypercalls. Anchoring on the initial namespace means firmware that re-unshares its own namespace stays in scope.

Changes

• pyplugins/core/scope.py (new) — enables driver-side gating when core.analysis_scope is set (via the set_scope_enabled portal op), early enough to also exclude pre-handoff boot machinery. Exposes plugins.scope.in_scope(pid), tracking in-scope pids from the (now driver-gated) exec_event stream.
• pyplugins/apis/syscalls.py — new scope_filter param on syscall(), defaulting to a hook's read_only value and plumbed into the kernel hook's scope_filter_enabled. Read-only logging hooks auto-scope; intervention hooks are unaffected.
• pyplugins/hyper/shell.py — replace the ad-hoc /igloo/ path filter with a lineage-correct plugins.scope.in_scope(pid) gate.
• pyplugins/{apis/execs,loggers/rw_logger,analysis/ficd,analysis/interfaces}.py — opt into scope_filter=True (they don't pass read_only). syscalls_logger already auto-scopes via read_only=True.
• src/resources/init.sh — handoff → exec /igloo/utils/busybox unshare -u "${igloo_init}".
• src/penguin/penguin_config/structure.py (+ regenerated docs/schema_doc.md) — core.analysis_scope (default true; set false to capture every process for debugging).
• src/penguin/defaults.py — enable the scope plugin by default.

env.py is intentionally left unscoped: its getenv/strstr hypercalls come from the libnvram LD_PRELOAD shim, which lib_inject injects only into firmware binaries, so it is already firmware-scoped by construction.

Testing

peng image (with the matching igloo_driver change) boots and runs the full test_target (rc 0) with scoping enabled; every logger subtest passes (netbinds, netbinds_lifecycle, env_cmp, env_unset, …), confirming in-scope firmware processes are still captured and the unshare doesn't break boot. The only failing subtest (indiv_debug+gdbserver) fails identically on the pre-scope baseline — environmental (broken vhost-vsock in the test runner), not a regression.

Dependencies

• Requires scope: gate analysis emission to the firmware process subtree igloo_driver#84 (the scope_filter_enabled hook field, set_scope_enabled portal op, and igloo_in_scope gating).
• Stacked on the bb_cov portalcall fix (shell: read guest memory via yielding portalcall API #869); shell.py's gate uses the generator form introduced there. Base will retarget to main once shell: read guest memory via yielding portalcall API #869 merges.