feat(sandbox): dynamic Linux sandbox expansion and worktree support#23692
feat(sandbox): dynamic Linux sandbox expansion and worktree support#23692
Conversation
- Extracts command validation and file system utilities (`commandUtils.ts`,
`fsUtils.ts`): from the macOS sandbox implementation into a shared `utils` directory.
- Updates `LinuxSandboxManager` to utilize these shared utilities for dynamic path
resolution, Git worktree access, and strict tool approval.
- Brings Linux sandbox capabilities to feature parity with macOS by supporting
`modeConfig` overrides (readonly, network, approved tools) and dynamic file system
permissions via Bubblewrap (`bwrap`) arguments.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the Linux sandbox manager, bringing its capabilities in line with the macOS Seatbelt implementation. The changes enable dynamic path resolution and robust Git worktree support, improving the security and flexibility of sandboxed operations on Linux. This is achieved by refactoring common utilities into a shared module and integrating advanced permission management within the Linux sandbox. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
Size Change: +5.16 kB (+0.02%) Total Size: 26.3 MB
ℹ️ View Unchanged
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors sandbox management logic by extracting common utility functions for command parsing and file system operations into new shared files (commandUtils.ts and fsUtils.ts). The Linux sandbox (LinuxSandboxManager) is enhanced to support more granular policy controls, including read-only modes, network access, explicit read/write permissions, and handling of forbidden paths, aligning its capabilities with the macOS sandbox. The sandboxManagerFactory is updated to correctly configure the Linux sandbox with policy information. The review identified a critical security vulnerability where the allowOverrides check in LinuxSandboxManager is incomplete, potentially allowing models to bypass network, allowed paths, and read restrictions in "Plan mode". Additionally, an inconsistency in workspace binding in LinuxSandboxManager was noted, and the path validation logic in fsUtils.ts was found to be brittle and potentially vulnerable to path traversal.
gemini-cli
bot
added
the
status/need-issue
…ace boundaries The introduction of `resolveAndValidatePath` inadvertently restricted explicitly granted additional file system permissions (e.g., from policies or tool approvals) to only paths within the workspace or `allowedPaths`. This caused authorized writes outside these boundaries to be silently ignored, resulting in read-only filesystem errors. This change reverts the resolution logic for `additionalPermissions` to use `tryRealpath`, restoring the ability to grant read and write access to arbitrary paths when explicitly approved, matching the behavior prior to the dynamic sandbox expansion changes.
…tion errors - Enhanced `resolveGitWorktreePaths` to fall back to parsing the `config` file for a `core.worktree` entry if the `gitdir` backlink is missing, properly supporting Git Submodules alongside Worktrees. - Added a `try/catch` block around `tryRealpath(p)` when iterating over `forbiddenPaths` in the Linux sandbox, preventing `prepareCommand` from crashing with `EACCES` on restricted intermediate directories. Unresolvable forbidden paths now log a warning and fallback to a simple string bind, maintaining graceful degradation.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2 participants
Summary
This PR brings the Linux Sandbox manager up to feature parity with the macOS Seatbelt implementation, introducing dynamic path resolution and Git worktree support.
Details
commandUtils.ts,fsUtils.ts) from the macOS sandbox implementation into a sharedutilsdirectory.LinuxSandboxManagerto utilize these shared utilities for dynamic path resolution, Git worktree access, and strict tool approval.modeConfigoverrides (readonly, network, approved tools) and dynamic file system permissions via Bubblewrap (bwrap) arguments.Related Issues
How to Validate
npm test -w @google/gemini-cli-core -- src/sandbox/linux/LinuxSandboxManager.test.tsPre-Merge Checklist