fix(sandbox): handle symlinks in allowed paths on Linux and macOS#102
Open
tito wants to merge 1 commit into
Open
fix(sandbox): handle symlinks in allowed paths on Linux and macOS#102tito wants to merge 1 commit into
tito wants to merge 1 commit into
Conversation
Symlinked allowRead/allowWrite entries previously broke inside the sandbox: on Linux, deny-by-default mode bound only the resolved target (or silently skipped symlink glob matches), so programs opening the original link path got ENOENT. Recreate the link with bwrap --symlink and bind its resolved target so both paths work. On macOS, emit Seatbelt rules for resolved targets of symlinked shell configs, home caches, and glob matches, since Seatbelt evaluates resolved paths. Symlinks inside allowed directories that point outside them now get their targets exposed read-only, controlled by the new filesystem.symlinkScan option: "shallow" (default, direct entries only), "deep" (recursive, capped), or "off". The scan never auto-exposes credential locations (SensitiveUserDirs); those still require an explicit allowRead grant, and denyRead continues to override anything the scan exposes. Denied symlinked paths now mask the resolved target so denied content cannot leak through the link. ExpandGlobPatterns moved to a platform-neutral file so glob expansion works on darwin instead of being stubbed out. Fixes #91
|
When will this PR be merged and released? |
Contributor
Author
|
I needed it to be tested on mac but didn't got time yet. Will do my best |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symlinked
allowRead/allowWriteentries previously broke inside the sandbox.Linux (deny-by-default): only the resolved target was bound (symlink glob matches were silently skipped entirely), so programs opening the original link path got ENOENT. The link is now recreated with bwrap
--symlinkand its resolved target bound at its real path, so both the link path andrealpath()-style access work. Applies to user allow paths, glob matches, and the default home paths (shell configs,~/.config, ...). Denied symlinked paths now mask the resolved target so denied content cannot leak through the link.macOS: Seatbelt evaluates resolved paths, so rules are now also emitted for resolved targets of symlinked shell configs, home caches, and glob matches.
ExpandGlobPatternsmoved to a platform-neutral file so glob expansion works on darwin instead of being stubbed out.Symlinks inside allowed directories pointing outside them get their targets exposed read-only, controlled by the new
filesystem.symlinkScanoption:"shallow"(default, direct entries only, one readdir per allowed dir),"deep"(recursive, capped at 10k entries), or"off". The scan neverauto-exposes credential locations (
SensitiveUserDirs:~/.ssh,~/.gnupg,~/.aws,.envfiles, ...); those still require an explicitallowReadgrant, anddenyReadoverrides anything the scan exposes.Docs: new "Symlinks in Allowed Paths" section in configuration.md and a
troubleshooting entry.
Fixes #91