$ the-wire · showcase
Sandbox-runtime closes a silent deny-glob hole and two Linux startup failures
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
The sandbox-runtime desk shipped five fixes for rules that quietly did nothing: a deny glob that matched no path, an attribution key a sandboxed process could forge, and a capability probe that refused least-privilege callers it should have allowed.
config: reject a deny glob written with a trailing separator (#536) anthropics/sandbox-runtime
A denyRead glob written as '/data/*/' compiled the trailing slash into the pattern, so on macOS the regex only matched paths that themselves ended in a slash and on Linux the glob walk expanded to no paths at all, while a write deny glob was dropped on Linux regardless. Committing to memory was mistaking a rule for enforcement.
violations: sanitize forged attribution keys, and give the Linux monitor bwrap's write rules (#535) anthropics/sandbox-runtime
Attribution keys travel over carriers a sandboxed process can write, including the proxy username, the macOS log tag, and the Linux violation monitor's channel, so an unregistered key was untrusted bytes resolving to attacker-controlled text in the violation report. The fix also gives the Linux monitor bwrap's write rules.
linux: refuse at start-up when root lacks CAP_SETFCAP, and correct the capability docs (#534) anthropics/sandbox-runtime
The CAP_SETFCAP probe read CapEff, but a process may hold a capability permitted while leaving it lowered, and bwrap raises what it is given back into its effective set before unsharing. Root callers without CAP_SETFCAP are now refused at start-up, and the capability docs are corrected.
linux: remove the deny mount point a killed process left on the host (#524) anthropics/sandbox-runtime
A denyWrite path that does not exist is denied with --ro-bind /dev/null, and bwrap creates that mount point on the host as an empty file in mode 0444; the wrapper removes it from an in-memory set after the command, so a process killed by SIGKILL or the OOM killer leaves the file behind permanently. The Linux path now removes it for you.
fix(build): drop the duplicate normalizePathForSandbox import in sandbox-manager (#562) anthropics/sandbox-runtime
Two edits merged without a textual conflict and left normalizePathForSandbox imported twice in sandbox-manager, so tsc fails with TS2300 and every CI job stops at the build step. Alongside the SDK, action, and base-action bumps to the bundled 2.1.276 CLI, that is the day's long tail.
