Skip to content

fix(sandbox): don't denyWrite read-only mounts; fix verify service label #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kskim9 wants to merge 2 commits into
base: main
Choose a base branch
from
+6 −3
Open

fix(sandbox): don't denyWrite read-only mounts; fix verify service label #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e45bc2
fix(sandbox): don't denyWrite read-only mounts so nested rw subdirs work
kskim9 May 8, 2026
375cbbc
fix(setup): use STATE_ROOT for service label detection in verify
kskim9 May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions setup/verify.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import path from 'path';

import Database from 'better-sqlite3';

import { DATA_DIR, STORE_DIR } from '../src/orchestrator/config.js';
import { DATA_DIR, STATE_ROOT, STORE_DIR } from '../src/orchestrator/config.js';
import { readEnvFile } from '../src/orchestrator/env.js';
import { logger } from '../src/orchestrator/logger.js';
import {
Expand All @@ -23,7 +23,7 @@ import {
import { emitStatus } from './status.js';

// Derive service label from data directory for instance-specific checks
const SERVICE_DIR_NAME = path.basename(DATA_DIR).replace(/[^a-zA-Z0-9_-]/g, '-');
const SERVICE_DIR_NAME = path.basename(STATE_ROOT).replace(/[^a-zA-Z0-9_-]/g, '-');
const SERVICE_LABEL = `com.claudeclaw.${SERVICE_DIR_NAME}`;
const SYSTEMD_UNIT = `claudeclaw-${SERVICE_DIR_NAME}`;

Expand Down
5 changes: 4 additions & 1 deletion src/runtimes/sandbox-runner.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,10 @@ export function buildSandboxSettings(
denyWrite.push(mount.hostPath);
} else if (mount.readonly) {
allowRead.push(mount.hostPath);
denyWrite.push(mount.hostPath); // enforce read-only at srt level
// Do NOT push to denyWrite: per srt config, denyWrite takes precedence
// over allowWrite, so adding a parent path here blocks nested writable
// mounts (e.g. groupDir inside projectRoot). Read-only is enforced
// implicitly: paths not present in allowWrite cannot be written.
} else {
// read-write
allowWrite.push(mount.hostPath);
Expand Down