Repository navigation
Tighten Claude Code sandbox write allowlist - #83
Merged
Merged
Conversation
Stop granting write to places a sandboxed write can run outside the
sandbox later:
- ~/.config/mise (config.toml and conf.d set PATH, tasks and hooks)
- ~/.config/gh (config.yml aliases can be `!shell` commands)
- ~/.cargo and ~/go narrowed to their cache dirs, so ~/.cargo/bin and
~/go/bin (both on PATH) are no longer writable
- absent rc locations that can name code to run: .yarnrc, .yarnrc.yml,
~/.config/{yarn,npm,pnpm,go,uv}, Library/Preferences/pnpm; ~/.yarn
narrows to ~/.yarn/berry (the global cache)
cargo install and go install now have to run outside the sandbox.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Claude Code's sandbox write allowlist (generated from
claude/stacks/*.jsonc) had grown by accretion, and a handful of entries let a sandboxed write run code outside the sandbox later. This trims those:~/.config/miseand~/.config/ghare no longer writable. mise config setsPATHand can name tasks and hooks, and gh aliases can be!shellcommands.~/.cargoand~/gonarrow to their cache dirs, so~/.cargo/binand~/go/bin(both onPATH) are read-only. A new~/.cargo/config.tomlcould also name arustc-wrapper..yarnrc,.yarnrc.yml,~/.config/{yarn,npm,pnpm,go,uv},Library/Preferences/pnpm. Each could be created to name code that runs on a later yarn, pnpm or go call.~/.yarnnarrows to~/.yarn/berry, where yarn 4 keeps its global cache.Each change has a one-line comment saying why. The cost:
cargo installandgo installnow have to run outside the sandbox.Test plan
./claudeconfig.shruns outside the sandbox (it writes~/.claude/settings.json). Afterwards,jq '.sandbox.filesystem.allowWrite' ~/.claude/settings.jsonshould no longer list the dropped entries.node_modulesin the new worktree); prettier passes on the stacks.Follow-up work
The audit found more that needs a decision first: mise trust state under
~/.local/state/mise,~/.bundle/configcredentials,~/.colima, and the dotslash cache. Reads are allow-default in Claude Code's sandbox, so credentials stay readable whatever this list says.🤖 Generated with Claude Code