search

bazelbuild / sandboxfs

A virtual file system for sandboxing
Apache License 2.0
372 stars 39 forks source link

Reach outside of sandboxfs #79

Closed Globegitter closed 5 years ago

Globegitter commented 5 years ago

I am just debugging a nodejs rule that seems to behave in a non-hermetic way (see https://github.com/bazelbuild/rules_nodejs/pull/612 if you are interested in background) and I thought sandboxfs can help me there with greater hermeticity, but the rule still behaves exactly the same way. So my question, given an absolute path is it still possible to access the filesystem outside of sandboxfs? And if so is there some way of blocking this?

jmmv commented 5 years ago

Yes, it's possible to reach absolute paths because sandboxfs does not actually do sandboxing. Grr, the name of this project is wrong...

See Bazel's --sandbox_block_path, which may help you.

Globegitter commented 5 years ago

I guess indirectly it helps, at least in the Bazel case, by not using symlinks anymore but yes names are hard. And thanks for the pointer to the flag.