Mnt/more hardening#9
Open
Thomas A Caswell (tacaswell) wants to merge 6 commits into
Open
Conversation
Address code-review findings in the shared sandbox library: - Add _version_ge (sort -V) and use it for bwrap/kernel capability detection, replacing manual major/minor/patch integer comparisons that mis-order versions like 0.11 vs 0.5. - Extract _emit_home_intermediate_dirs to replace the copy-pasted "create intermediate --dir entries under $HOME" loops; this also fixes a latent bug emitting bogus --dir entries for files directly under $HOME. - Cache `npm prefix -g` in _get_npm_prefix so the subprocess runs at most once per invocation instead of per symlinked tool. - print_dry_run: group flags with their values by known flag arity (_bwrap_flag_arity) instead of the leading "--" heuristic, so a path value beginning with -- is no longer misread as a new flag. - build_env_vars fallback: read compgen -e via while/read and skip names that are not portable identifiers (e.g. BASH_FUNC_* function exports); note the argument-length growth on the legacy path. - _mount_ro_dir_if_needed / _bind_authoring_dir: prefix walk now also tests "/" so a mount of "/" would de-duplicate. - Simplify _is_prefix_of to a single test. - Extend the blocked-path list with password-manager stores (~/.password-store, ~/.config/1Password, ~/.config/op). Done with 🤖 (Opus 4.8) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Replace `for k in $(compgen -e)` with `while IFS= read -r k; do ... done < <(compgen -e)` in build_claude_env / build_codex_env / build_opencode_env so exported-var names are not word-split on IFS. - Use the shared _emit_home_intermediate_dirs helper in build_claude_home_mount / build_codex_home_mount / build_copilot_home_mount instead of inline ancestor-dir loops. - Note in build_claude_env that bwclaude is hard-wired for the NSLS-II AIFAPIM/foundry gateway and needs modification to run elsewhere. Done with 🤖 (Sonnet 4.6) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Guard against bash < 4.0 (the script uses arrays, [[ ]], and =~). - Collapse the two-stage show_help sed pipeline into a single sed. - Make the owner/repo validation error show the expected format with an example and the offending input on its own line. Done with 🤖 (Sonnet 4.6) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- decrypt_env_file checks required vars via a bash nameref instead of
`eval "value=\${$var:-}"`, removing the variable-name eval.
- Add a .gitignore covering Emacs/Vim backup and swap files so editor
autosaves (e.g. #README.md#) cannot be committed by accident.
Done with 🤖 (Sonnet 4.6)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Draft
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bash hardening / consolation
Description
Let claude self-manage this.
Testing
I've been using this locally.
Checklist
pixi run -e dev lintlocally (or wait for CI) — see.github/workflows/lint.ymlrunansibledeployment)