Richard/ClawdDotNet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sandbox: Startprobe bindet das System wie ein echter Lauf ein (#654)

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Richard
2026-09-25 20:28:36 +02:00
co-authored by Claude Opus 5.5
parent 257ba87cf5
commit da39fb3e91
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs
+7 -2
View File
@@ -62,8 +62,13 @@ public sealed class BwrapSandbox : ISandboxRunner
return new NoSandbox("bubblewrap (bwrap) is not installed — 'apt install bubblewrap'"); return new NoSandbox("bubblewrap (bwrap) is not installed — 'apt install bubblewrap'");
var help = RunQuiet(bwrap, ["--help"]); var help = RunQuiet(bwrap, ["--help"]);
var probe = RunQuiet(bwrap, ["--unshare-all", "--die-with-parent", "--ro-bind", "/usr", "/usr", // The probe mounts the system exactly as a real run does — a missing /lib64 (the
"--symlink", "usr/bin", "/bin", "--symlink", "usr/lib", "/lib", "--proc", "/proc", "--dev", "/dev", "/bin/true"]); // dynamic loader) looks like "no such file" and would pass for a broken sandbox.
var probeArgs = new List<string> { "--unshare-all", "--die-with-parent", "--ro-bind", "/usr", "/usr" };
foreach (var (path, link) in HostLayout.Read().TopLevel)
probeArgs.AddRange(link is not null ? ["--symlink", link, path] : ["--ro-bind-try", path, path]);
probeArgs.AddRange(["--proc", "/proc", "--dev", "/dev", "/usr/bin/true"]);
var probe = RunQuiet(bwrap, probeArgs);
if (probe.ExitCode != 0) if (probe.ExitCode != 0)
return new NoSandbox($"bwrap cannot create a sandbox here ({probe.Output.Trim()}) — user namespaces may be disabled"); return new NoSandbox($"bwrap cannot create a sandbox here ({probe.Output.Trim()}) — user namespaces may be disabled");