fix(sandbox): Landlock FS bound plus workspace_only defense-in-depth - #88

Closed

adriannoes wants to merge 30 commits into

developmentfrom

cursor/sandbox-fs-landlock-d519

Commits on Sep 14, 2026

test(sandbox): reject .. escapes for nonexistent shell destinations
adriannoes
committed
39c73af
fix(sandbox): walk existing ancestor before workspace prefix check
adriannoes
committed
cd27ada
test(sandbox): reject quoted and embedded absolute shell paths
adriannoes
committed
6597943
fix(sandbox): scan quoted and embedded absolute paths in allowlist
adriannoes
committed
68ed422
test(sandbox): reject $HOME and $PWD expansions in workspace allowlist
adriannoes
committed
6fd886a
fix(sandbox): expand $HOME and $PWD before workspace allowlist checks
adriannoes
committed
152e862
test(sandbox): reject glued $IFS and mid-token $HOME expansions
adriannoes
committed
9c346db
fix(sandbox): scan $ expansions on the full shell command
adriannoes
committed
b80912d
docs(sandbox): record workspace_only glued-$ gate and residuals
adriannoes
committed
ccbda3c
test(sandbox): reject missing-dir .., file: URLs, and embedded ../
adriannoes
committed
f7abfc3
fix(sandbox): collapse .. lexically and scan file: plus embedded ../
adriannoes
committed
496a7dd
fix(sandbox): zero-init lexical collapse segment pointers
adriannoes
committed
2ee46b6
test(sandbox): reject encoded slash, HOME/PWD assign, symlink .., file %
adriannoes
committed
6631ec7
fix(sandbox): block encoded slash, HOME/PWD assign, symlink .., file %
adriannoes
committed
8ea72e9
fix(sandbox): narrow encoded-slash octal locals for cppcheck
adriannoes
committed
231b3f0
test(sandbox): reject quoted HOME/PWD assign, split file:, encoded dot
adriannoes
committed
283206f
fix(sandbox): catch quoted HOME/PWD, split file:, encoded dot/N
adriannoes
committed
8b3d5c1
fix(sandbox): narrow encoded-dot hex local for cppcheck
adriannoes
committed
efda63f
test(sandbox): reject URL ../, Perl \\x{}, env -i/pop, comma HOME=
adriannoes
committed
1206218
fix(sandbox): catch URL ../, Perl \x{}, env -i/pop, comma HOME=
adriannoes
committed
2b10dfe
test(sandbox): reject read/unset env, Perl \o{}, encoded file:
adriannoes
committed
88cf550
fix(sandbox): catch read/--unset/-iu, Perl \o{}, encoded file:
adriannoes
committed
4eb3ae5
test(sandbox): reject octal/identity file:, \\+nl, printf -v
adriannoes
committed
3ecd673
fix(sandbox): catch octal/identity file:, \\+nl, printf -v
adriannoes
committed
ffafa0b
test(sandbox): reject identity HOME/PWD, nameref, encoded $
adriannoes
committed
5d53b60
fix(sandbox): fold identity before HOME/PWD; decode encoded $
adriannoes
committed
83780a5
test(sandbox): reject relative leak tokens, Landlock host FS, netns
adriannoes
committed
7c34828
fix(sandbox): Landlock workspace bound; fail closed without ns
adriannoes
committed
87123a5
ci: allow unprivileged userns on Ubuntu 24.04 runners
adriannoes
committed
c8826a3
test(sandbox): skip or expect deny when isolation cannot apply
adriannoes
committed
04f7492

Navigation Menu

fix(sandbox): Landlock FS bound plus workspace_only defense-in-depth - #88

fix(sandbox): Landlock FS bound plus workspace_only defense-in-depth#88
adriannoes wants to merge 30 commits into
developmentfrom
cursor/sandbox-fs-landlock-d519

Commits on Sep 14, 2026

test(sandbox): reject .. escapes for nonexistent shell destinations

fix(sandbox): walk existing ancestor before workspace prefix check

test(sandbox): reject quoted and embedded absolute shell paths

fix(sandbox): scan quoted and embedded absolute paths in allowlist

test(sandbox): reject $HOME and $PWD expansions in workspace allowlist

fix(sandbox): expand $HOME and $PWD before workspace allowlist checks

test(sandbox): reject glued $IFS and mid-token $HOME expansions

fix(sandbox): scan $ expansions on the full shell command

docs(sandbox): record workspace_only glued-$ gate and residuals

test(sandbox): reject missing-dir .., file: URLs, and embedded ../

fix(sandbox): collapse .. lexically and scan file: plus embedded ../

fix(sandbox): zero-init lexical collapse segment pointers

test(sandbox): reject encoded slash, HOME/PWD assign, symlink .., file %

fix(sandbox): block encoded slash, HOME/PWD assign, symlink .., file %

fix(sandbox): narrow encoded-slash octal locals for cppcheck

test(sandbox): reject quoted HOME/PWD assign, split file:, encoded dot

fix(sandbox): catch quoted HOME/PWD, split file:, encoded dot/N

fix(sandbox): narrow encoded-dot hex local for cppcheck

test(sandbox): reject URL ../, Perl \\x{}, env -i/pop, comma HOME=

fix(sandbox): catch URL ../, Perl \x{}, env -i/pop, comma HOME=

test(sandbox): reject read/unset env, Perl \o{}, encoded file:

fix(sandbox): catch read/--unset/-iu, Perl \o{}, encoded file:

test(sandbox): reject octal/identity file:, \\+nl, printf -v

fix(sandbox): catch octal/identity file:, \\+nl, printf -v

test(sandbox): reject identity HOME/PWD, nameref, encoded $

fix(sandbox): fold identity before HOME/PWD; decode encoded $

test(sandbox): reject relative leak tokens, Landlock host FS, netns

fix(sandbox): Landlock workspace bound; fail closed without ns

ci: allow unprivileged userns on Ubuntu 24.04 runners

test(sandbox): skip or expect deny when isolation cannot apply