Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

sandbox: workspace confinement accepts /, $HOME, and symlink aliases of $HOME

Open
  • Is something wrong?
#112 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend, security

Research direction

Start with sandbox/box_linux.go at line 63 and sandbox/linux.go around lines 236–245, then read the existing workspace validation and workspaceRules code. Add tests for /, the home directory, and a symlink alias of home; run the relevant Go tests. Done means those roots are rejected and the symlink comparison is covered by tests.

Written by the indexing model from the issue text.

Description

bug help wanted

Problem

Three related confinement gaps across packages/sandbox:

  1. box_linux.go:63 — the workspace-path validation accepts / and the literal value of $HOME as valid workspace roots, rather than rejecting roots that are (or resolve to) the filesystem root or the user's home directory.
  2. linux.go:245 — the check that compares a candidate path against the home directory does a plain string comparison, so a symlink that points at the home directory but has a different literal path string bypasses the comparison.
  3. linux.go:236 — workspaceRules has no test coverage, so regressions in this confinement logic would not be caught by CI.

Impact

An agent configured (or tricked) into using / or $HOME as its workspace root effectively runs unconfined against the whole filesystem or the user's full home directory, defeating the purpose of workspace sandboxing. The symlink gap means even a correct literal-path check can be routed around by aliasing the home directory through a symlink elsewhere in the filesystem.

Repro

  1. Configure the sandbox workspace root to / (or to the exact value of $HOME) and observe the validation accepts it instead of rejecting an unreasonably broad root.
  2. Create a symlink elsewhere that points at the home directory, configure that symlink path as the workspace root, and observe the home-directory comparison does not catch it because the literal path differs.

Suggested fix

In box_linux.go, explicitly reject workspace roots that resolve (after filepath.EvalSymlinks and filepath.Clean) to / or to the current user's home directory, rather than relying on literal string matches. In linux.go:245, resolve both the candidate path and the home directory with filepath.EvalSymlinks before comparing, so symlink aliases are caught. Add unit tests for workspaceRules covering the root, home-directory, and symlink-alias cases.

Dominant language
Go
Stars
157
Forks
19
Avg merge
4h 43m
Merged PRs (30d)
68

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from solongate/agent-security

All issues in solongate/agent-security

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.