mrtoth
14c4f44a1f
Bind persistent tmp dirs with --bind-fd so the sandbox inherits no host descriptor
2026-11-04 18:10:43 +01:00
mrtoth
b5937b1a84
Upgrade dependencies
2026-11-04 03:04:21 +01:00
mrtoth
5f737f71c9
Point AGENTS.md at the hephaestus-managed config and document agent dir env vars
2026-11-04 03:04:21 +01:00
mrtoth
c8953ea0ec
Remove the hardcoded agent config binds
2026-11-04 03:04:21 +01:00
mrtoth
0fb86fed07
Shorten the cleanup grace period in the e2e tests
2026-11-04 02:57:49 +01:00
mrtoth
7465af5d41
Mirror signal deaths from real-time signals
2026-11-04 02:57:49 +01:00
mrtoth
599d86ccbf
Kill the child processes at once on a second interrupt during the grace period
2026-11-04 02:50:35 +01:00
mrtoth
5389ac97ac
Test Ctrl-C, job control and hangup with an interactive shell on a terminal
2026-11-04 02:50:35 +01:00
mrtoth
04abf264a0
Forward signals to the child processes of agent-sandbox
2026-11-04 01:40:37 +01:00
mrtoth
cef73d27db
Repeat the process tree walk and spare processes started by signal handlers
2026-10-31 14:47:05 +01:00
mrtoth
29851dc5df
Terminate leftover child processes of the entrypoint after bwrap exits
2026-10-31 14:25:17 +01:00
mrtoth
1c2f51ed3b
Spawn bwrap and mirror its exit status instead of exec'ing into it
2026-10-31 01:55:36 +01:00
mrtoth
c17e8c7c5d
Upgrade dependencies
2026-10-01 20:41:28 +02:00
mrtoth
fbb78d485f
Accept a list of profiles on the CLI and in the config
2026-10-01 20:32:38 +02:00
mrtoth
1e7e632a4a
Add llama.cpp API key to example config
2026-09-27 18:43:39 +02:00
mrtoth
0ce9ca7816
Use yolo mode in example config
2026-09-26 20:31:03 +02:00
mrtoth
0cb7d68945
Keep env values off the bwrap command line
2026-09-17 12:26:01 +02:00
mrtoth
d518c3e482
Drop --map-root-user from the seccomp unshare tests
2026-09-17 12:24:55 +02:00
mrtoth
7d5db4f3d5
Replace deprecated AGENTS.md --ro path in the config-example
2026-09-07 18:16:20 +02:00
mrtoth
c8f2d62b64
Expose the bwrap command line at /run/agent-sandbox inside every sandbox
2026-09-02 16:09:46 +02:00
mrtoth
9185d1fb26
Reorder claude entrypoint so a trailing prompt survives arg parsing
2026-08-03 01:17:28 +02:00
mrtoth
0c3dfe0fb5
Add ~/.config/git to --ro list by default
2026-07-07 05:04:31 +02:00
mrtoth
48a80b568e
Drop claude-yolo profile, allow selecting yolo mode from claude code
2026-07-07 05:01:38 +02:00
mrtoth
4babf33439
Expand default path coverage for common tools
2026-05-15 10:08:22 +02:00
mrtoth
3fb0da0577
Optionally back /tmp and /var/tmp with stable host directories
2026-05-15 01:36:58 +02:00
mrtoth
28e68b0fff
Disable doc-tests
2026-05-14 19:14:19 +02:00
mrtoth
26358a57da
Add more tools to claude profile's allowedTools
2026-05-02 02:39:38 +02:00
mrtoth
38f09ac461
Remove non-functional pattern from claude allowedTools, add working one
2026-04-30 16:54:12 +02:00
mrtoth
1165aea9aa
Stop overriding the sandbox hostname
...
Setting --hostname sandbox inside the UTS namespace was purely cosmetic
(a label for interactive shells) and provided no isolation beyond what
--unshare-uts already gives. It also caused codex to hang for ~5s on
startup: glibc resolved the unknown "sandbox" name via systemd-resolved
and waited through two DNS retry timeouts before giving up.
Dropping the override lets the sandbox inherit the host's hostname,
which already resolves locally, eliminating the stall.
2026-04-27 21:08:05 +02:00
mrtoth
105eafef2e
Move codex home
2026-04-27 09:32:39 +02:00
mrtoth
af731a107f
Add pi agent profile
2026-04-27 08:38:15 +02:00
mrtoth
6e81866226
Default to whitelist mode and parallelize tests
...
Flips the default sandbox mode from blacklist to whitelist and
replaces the global RUST_TEST_THREADS=1 with a targeted RwLock
that only serializes blacklist sandboxes against tests mutating
glob-matching host paths. A new Sandbox newtype acquires the
guard automatically when --blacklist is in args.
2026-04-27 08:18:41 +02:00
mrtoth
c77dbc10c3
Implement profile inheritance
2026-04-26 23:58:21 +02:00
mrtoth
7f9b21ef4f
Organize test code better
2026-04-25 15:10:42 +02:00
mrtoth
0ea83b2af0
Implement extra-config option
2026-04-24 20:09:27 +02:00
mrtoth
a9f5593f03
Extract claude and codex configs into separate profiles
2026-04-24 08:31:37 +02:00
mrtoth
7c9375cd94
Canonicalize blacklist overlay paths to skirt /var/run symlink
2026-04-23 18:47:27 +02:00
mrtoth
862feada05
Document hardening, network default, and profile merge rules
2026-04-22 23:14:51 +02:00
mrtoth
6933deb441
Document config-example.toml as the canonical deployed config
...
Makes it clear that the example config is meant to be symlinked into
$XDG_CONFIG_HOME/agent-sandbox/ so it stays in sync with the repo.
2026-04-22 22:43:46 +02:00
mrtoth
972747a891
Whitelist terminal identity and pager env vars
...
Without TERM_PROGRAM/TERM_PROGRAM_VERSION, Claude Code and similar TUIs
can't detect the host emulator and lose capability-gated features like
Shift+Enter. Also pass through LS_COLORS, LESS*, MANPAGER, MANPATH, etc.
so interactive UX matches the host.
2026-04-22 22:34:01 +02:00
mrtoth
1e9b7735a8
Mount agent-config repo ro in example config
2026-04-22 21:51:15 +02:00
mrtoth
305ac9d927
Accept SRC:DST remap syntax in --ro/--rw
2026-04-22 21:51:00 +02:00
mrtoth
06bb638737
Document all config options with commented examples
2026-04-22 20:55:07 +02:00
mrtoth
494da52fc6
Replace setenv with env list supporting host passthrough
2026-04-22 20:47:01 +02:00
mrtoth
76c5be0e72
Fix misinformation in seccomp comments
2026-04-13 17:03:38 +02:00
mrtoth
7b7294d94e
Follow symlinks when classifying sensitive paths in blacklist mode
2026-04-13 16:49:42 +02:00
mrtoth
bd1f938f54
Block CLONE_NEWUSER in seccomp argument filter on clone
...
Prevents sandboxed processes from creating user namespaces to gain fake
root, the standard entry point for kernel privilege-escalation exploits.
Matches Docker and Podman's default seccomp policy.
clone3 remains fully denied (not in the allowlist) so glibc falls back
to clone where this argument filter applies.
Also switches hand-written ioctl constants to libc::{TIOCSTI,TIOCLINUX}.
2026-04-13 16:46:15 +02:00
mrtoth
0d0682b04e
Replace --new-session with seccomp TIOCSTI/TIOCLINUX filter
2026-04-12 15:58:50 +02:00
mrtoth
8f30d28965
Let --rw override --ro on a child path by emitting ro binds first
2026-04-12 14:36:07 +02:00
mrtoth
327c2933e7
Add README note about ubuntu apparmor woes with bubblewrap
2026-04-08 09:27:40 +02:00
mrtoth