From d97d4313f18c2777bb78059687fc7abb1d332264 Mon Sep 17 00:00:00 2001 From: Richard Date: Fri, 25 Sep 2026 20:31:32 +0200 Subject: [PATCH] Sandbox: Wurzel schreibgeschuetzt, Filter-Deskriptor geschlossen (#654) Co-Authored-By: Claude Opus 5.5 --- src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs b/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs index b695344..58639ef 100644 --- a/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs +++ b/src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs @@ -170,7 +170,9 @@ public sealed class BwrapSandbox : ISandboxRunner foreach (var path in request.ReadOnlyPaths) args.AddRange(["--ro-bind", Path.GetFullPath(path), Path.GetFullPath(path)]); - args.AddRange(["--chdir", SandboxPaths.Work]); + // The root bwrap builds is a tmpfs of its own — writable unless it is remounted. Only + // /work and /tmp, each a mount of its own, stay writable. + args.AddRange(["--remount-ro", "/", "--chdir", SandboxPaths.Work]); var environment = new Dictionary(StringComparer.Ordinal) { @@ -186,9 +188,10 @@ public sealed class BwrapSandbox : ISandboxRunner args.AddRange(["--seccomp", "3", "--"]); - // Inner: the process limit, set inside the sandbox's own user namespace. bash calls it - // -u, dash (Debian's and Ubuntu's sh) -p; if neither takes, nothing runs. - args.AddRange([Shell, "-c", """ulimit -u "$1" 2>/dev/null || ulimit -p "$1" || exit 126; shift; exec "$@" """, "sh", + // Inner: fd 3 — the filter bwrap read — is closed; bwrap hands it on otherwise. Then + // the process limit, set inside the sandbox's own user namespace. bash calls it -u, + // dash (Debian's and Ubuntu's sh) -p; if neither takes, nothing runs. + args.AddRange([Shell, "-c", """exec 3<&-; ulimit -u "$1" 2>/dev/null || ulimit -p "$1" || exit 126; shift; exec "$@" """, "sh", limits.MaxProcesses.ToString(CultureInfo.InvariantCulture), request.Executable]); args.AddRange(request.Arguments); return args;