Why are only `--rox`, `--ro` generous?

[bglgwyng]

https://github.com/srid/sandnix/blob/master/modules/flake-parts/sandnix/linux/wrapper.nix#L36-L40

This caused nix run ./examples/claude-sandboxed to fail on my machine, since the directories don't exist yet. Not a big deal, but I'm curious about the intention behind this — is it expected that these paths are pre-initialized?

Also, I noticed that --rox and --ro paths are conditionally added (only if the path exists), while --rwx and --rw are always passed as static args. What's the reasoning behind treating them differently?

[adrian-gierakowski]

This is due to how linux's landlock works: it uses inodes instead of paths, the file\dir needs to exist for the inode to exist, so non-existent paths cannot be added to the sandbox (btw. on macos the sandbox filters file system access based on actual paths so this limitation does not apply).

--rox and --ro paths are conditionally added (only if the path exists)

It's ok to skip them since the expectation is that the sandboxed program is only going to read them (and not attempt to create\modify them). If they are not there, the program is still likely to function, so no point failing early.

In the case of rw(x) paths, if you skip them and the program attempts to create them, it will fail with permission denied, therefore the contract is broken: we started the sandbox without giving the program the requested capabilities.

[adrian-gierakowski]

Btw. the solution is to add a preHook which creates required dirs\files before starting the sandbox #21

[bglgwyng]

Thanks!