Repository navigation
fix(sandbox): create the jail's HOME directory with bwrap --dir - #3
Merged
Merged
Conversation
`parenting--sandbox-command-wrapper` pointed HOME at <socket-directory>/home but nothing created that directory. The socket directory is bind-mounted read-write at its own path, so HOME lay inside a writable mount, yet the `home` subdirectory did not exist. A --batch child never writes to HOME; a --fg-daemon child does (savehist, recentf, the native-comp eln cache, `user-emacs-directory') and failed on the missing directory. Emit `--dir <home>` after the socket-directory `--bind` (so the mount exists when the directory is created inside it) and before `--clearenv`/`--setenv HOME`. Correct the comments and docstrings that called this HOME "on the tmpfs": it is a directory created per child under the read-write socket-directory bind, removed with the socket directory at shutdown. Tests: `parenting-sandbox-wrapper-core-flags` now asserts the argument list carries exactly one `--dir` whose value is (expand-file-name "home" <socket-dir>), positioned after the socket-directory bind and before `--setenv HOME`. `parenting-spawn-sandbox-child-roundtrips` additionally asserts, from inside the jail, that (getenv "HOME") is an existing, writable directory. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
parenting--sandbox-command-wrapperpointsHOMEat<socket-directory>/homeand its comment said that was "a writable HOME on the tmpfs". Nothing created the directory, and it is not on the tmpfs: the socket directory is a read-write bind at the same path, and/tmpis the tmpfs. A--batchchild never writes toHOME, so the sandbox tests passed; a--fg-daemonchild does (savehist, recentf, the native-comp cache,user-emacs-directory) and fails on the missing directory.The fix
The wrapper now emits
--dir <home>after the socket-directory--bind(so the mount exists when the directory is created inside it) and before--clearenvand--setenv HOME. bwrap's--dircreates the directory in the jail; it lives under the read-write bind and goes away with the socket directory at shutdown. The docstrings and comments that said "tmpfs" now say that.Tests
parenting-sandbox-wrapper-core-flagsasserts the--dirvalue is<socket-dir>/homeand that it sits after the socket--bindand before--setenv HOME. The guarded integration testparenting-spawn-sandbox-child-roundtripsnow asserts, inside the child, that(getenv "HOME")is an existing writable directory; on this machine bwrap can create a user namespace, so that ran in a real jail rather than skipping.make compileis clean;Ran 56 tests, 56 results as expected, 0 unexpected, the same on clean main.🤖 Generated with Claude Code