From 0bf08a18fe48a2384ea4cd296a3fd0db9a685f81 Mon Sep 17 00:00:00 2001 From: Richard Date: Fri, 25 Sep 2026 20:30:01 +0200 Subject: [PATCH] Sandbox: Prozessgrenze auch unter dash (ulimit -p) (#654) Co-Authored-By: Claude Opus 5.5 --- src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs b/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs index 3f5898f..b695344 100644 --- a/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs +++ b/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs @@ -186,8 +186,9 @@ public sealed class BwrapSandbox : ISandboxRunner args.AddRange(["--seccomp", "3", "--"]); - // Inner: the process limit, set inside the sandbox's own user namespace. - args.AddRange([Shell, "-c", """ulimit -u "$1" || exit 126; shift; exec "$@" """, "sh", + // Inner: the process limit, set inside the sandbox's own user namespace. bash calls it + // -u, dash (Debian's and Ubuntu's sh) -p; if neither takes, nothing runs. + args.AddRange([Shell, "-c", """ulimit -u "$1" 2>/dev/null || ulimit -p "$1" || exit 126; shift; exec "$@" """, "sh", limits.MaxProcesses.ToString(CultureInfo.InvariantCulture), request.Executable]); args.AddRange(request.Arguments); return args;