macOS: pin mandatory-deny directories at any depth - #484
Open
ant-kurt wants to merge 3 commits into
Open
Conversation
…ory denies on Windows macOS: generateMoveBlockingRules derived rename protection from a deny glob's static prefix, so for the cwd-anchored `**/.git/config` and `**/.git/hooks/**` globs only the literal `<cwd>/.git` was pinned. A sandboxed command could prepare a directory holding a config with core.fsmonitor and rename it onto `packages/app/.git` (or mkdir / symlink it); Seatbelt checks the rename target, not the children carried with it. Every glob-shaped ancestor (`**/.git`, `**/.claude`, ...) is now denied file-write-create / file-write-unlink at any depth, exact match, so writes inside an existing nested .git keep working. Creating or removing a nested .git (git init, clone, worktree add, rm -rf of a nested repo) inside the sandbox is now denied. Windows: the ACL stamp only covered the caller's own denyWrite. The mandatory set (.git/hooks, .git/config, shell rc files, IDE dirs) is now expanded to existing paths under cwd, bounded by mandatoryDenySearchDepth via a new expandGlobPattern maxDepth option, and unioned into denyWrite. Linux is unchanged: bubblewrap can only mask paths that exist at command start (documented limitation).
ant-kurt
changed the title
ant-kurt
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The move-blocking rules only pinned the literal
<cwd>/.git, so a nested.gitcould be created, renamed onto, or renamed away at any depth. Every glob-shaped ancestor of a deny glob (**/.git,**/.claude, …) is now deniedfile-write-create/file-write-unlink, exact match. Writes inside an existing nested.gitstill work; creating or removing a nested.gitinside the sandbox (git init,clone,worktree add,rm -rfof a nested repo) is now denied. The README's mandatory-deny section states this and summarizes macOS vs Linux coverage.Test plan
macos-seatbelt.test.ts"Nested .git Swap Prevention": rename of a prepared directory onto a nested.git,mkdir/symlink of a nested.git, and renaming an existing nested.gitaway are denied;index.lock → indexandrefs/writes inside an existing nested.gitsucceed. Existing suite unchanged.