Skip to content

fix(linux): skip creating host stubs for non-existent deny paths #495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gwatkins-arista wants to merge 1 commit into
base: main
Choose a base branch
from
+10 −9
Open

fix(linux): skip creating host stubs for non-existent deny paths #495

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions src/sandbox/linux-sandbox-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,10 +286,12 @@ async function linuxGetMandatoryDenyPaths(

// Note: Settings files are added at the callsite in sandbox-manager.ts
const denyPaths = [
// Dangerous files in CWD
...DANGEROUS_FILES.map(f => path.resolve(cwd, f)),
// Dangerous directories in CWD
...dangerousDirectories.map(d => path.resolve(cwd, d)),
// Dangerous files in CWD - only protect if they actually exist on disk.
// Non-existent dangerous files should NOT have host mount points created for them,
// which would pollute the working directory with 0-byte ghost dotfiles.
...DANGEROUS_FILES.map(f => path.resolve(cwd, f)).filter(p => fs.existsSync(p)),
// Dangerous directories in CWD - only protect if they exist
...dangerousDirectories.map(d => path.resolve(cwd, d)).filter(p => fs.existsSync(p)),
]

// Git hooks and config are only denied when .git exists as a directory.
Expand Down Expand Up @@ -1398,12 +1400,11 @@ async function generateFilesystemArgs(
`[Sandbox Linux] Mounted empty dir at ${firstNonExistent} to block creation of ${normalizedPath}`,
)
} else {
denyWriteArgs.push('--ro-bind', '/dev/null', firstNonExistent)
denyWriteRawDests.set(firstNonExistent, rawPath)
bwrapMountPoints.add(firstNonExistent)
registerExitCleanupHandler()
// Do not create empty files on the host for non-existent leaf deny paths.
// Creating host stub files for missing paths pollutes the repository with ghost
// dotfiles and causes race conditions with concurrent bwrap instances.
logForDebugging(
`[Sandbox Linux] Mounted /dev/null at ${firstNonExistent} to block creation of ${normalizedPath}`,
`[Sandbox Linux] Skipping non-existent leaf deny path to avoid creating host ghost files: ${normalizedPath}`,
)
}
} else if (ancestorIsWithinReadOnlyDeny) {
Expand Down