Finding and validation status
Daybreak Blue source review identified a documented real-filesystem trust limitation, not a newly reproduced sandbox escape. Track whether deployment constraints or additional hardening are needed for safe-bash consumers.
The real adapter explicitly excludes pre-existing hardlinks, ancestor swaps, concurrent renames and mount changes from its confinement guarantee: current source.
A pre-existing hardlink under the configured root can alias an outside file on the same filesystem. Native reads/writes act on that inode. This requires a host principal/process with permission to establish the alias; this review did not establish that an untrusted safe-bash script can create an outside-root alias. Concurrent ancestor mutation is also outside the documented guarantee.
Impact and prerequisites
Potential outside-root content access where deployment incorrectly treats a host-mutated root as an isolation boundary. Severity is deployment-dependent; no unconditional High severity is claimed.
Evidence and remaining validation
Reviewed source at d126d35. No host hardlink or race reproduction was performed. This is a security-hardening/triage issue, not a confirmed new vulnerability.
Acceptance criteria
- Determine whether supported deployments allow hostile host mutation or pre-existing external hardlinks.
- Validate relevant behavior using isolated owned fixtures or mocked filesystem operations before changing code.
- Define and enforce the supported boundary or document deployment requirements with maintainer approval; do not claim pathname checks provide OS isolation.
Finding and validation status
Daybreak Blue source review identified a documented real-filesystem trust limitation, not a newly reproduced sandbox escape. Track whether deployment constraints or additional hardening are needed for safe-bash consumers.
The real adapter explicitly excludes pre-existing hardlinks, ancestor swaps, concurrent renames and mount changes from its confinement guarantee: current source.
A pre-existing hardlink under the configured root can alias an outside file on the same filesystem. Native reads/writes act on that inode. This requires a host principal/process with permission to establish the alias; this review did not establish that an untrusted safe-bash script can create an outside-root alias. Concurrent ancestor mutation is also outside the documented guarantee.
Impact and prerequisites
Potential outside-root content access where deployment incorrectly treats a host-mutated root as an isolation boundary. Severity is deployment-dependent; no unconditional High severity is claimed.
Evidence and remaining validation
Reviewed source at d126d35. No host hardlink or race reproduction was performed. This is a security-hardening/triage issue, not a confirmed new vulnerability.
Acceptance criteria