fix(cli): resolve permission denied in sandbox on NixOS and other distros#27004
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses permission denied (EACCES) errors occurring in sandbox mode on Linux distributions where the host user's UID is not 1000. By improving distribution detection and implementing a more robust, defensive entrypoint script, the changes ensure that the sandbox environment correctly handles user mapping across a wider range of Linux environments while maintaining compatibility with minimal container images. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
eb536d2 to
0238082
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances sandbox compatibility across various Linux distributions by expanding the list of supported distros (including NixOS, Arch, Fedora, and Suse) and implementing a defensive entrypoint that checks for useradd availability before attempting user mapping. It also introduces a warning for potential UID mismatches on unrecognized Linux systems and includes corresponding unit tests. Feedback was provided to improve the robustness of the shell commands, specifically regarding the handling of spaces in home directory paths, ensuring non-unique GID support for groupadd, and improving the script's formatting for better readability.
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
0238082 to
ad0d6af
Compare
|
Size Change: +882 B (0%) Total Size: 34.1 MB
ℹ️ View Unchanged
|
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces defensive entrypoint logic to the sandbox to support minimal container images and expands automatic UID/GID mapping to additional Linux distributions like NixOS, Arch, and Fedora. Feedback highlights a security risk where the fallback to root execution could lead to privilege escalation, suggesting an explicit error instead. Additionally, there are concerns regarding potential command injection via unescaped home directory paths and a recommendation to use anchored regular expressions for more reliable OS distribution detection in /etc/os-release.
gemini-cli
Bot
added
priority/p1
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
ad0d6af to
18b87f4
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request expands the list of supported Linux distributions for automatic UID/GID mapping in the sandbox and introduces a defensive entrypoint script to handle user creation more robustly. Review feedback pointed out that the distribution detection regex lacks support for quoted values and identified potential GID mismatches in the user setup logic.
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
18b87f4 to
6232e05
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request improves sandbox UID/GID mapping by expanding Linux distribution support and introducing a defensive entrypoint script that checks for user management tools. A security issue was identified in the new entrypoint logic where a failure in UID mapping could lead to an insecure fallback to root execution; a code suggestion was provided to validate the username before switching users.
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
6232e05 to
a2c9a53
Compare
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request improves sandbox user management by introducing a defensive entrypoint that verifies 'useradd' availability before performing UID/GID mapping. It also extends automatic user mapping support to additional Linux distributions like NixOS, Arch, Fedora, and Suse, while adding warnings for UID mismatches on unrecognized systems. I have no feedback to provide as no review comments were present.
cocosheng-g
force-pushed
the
fix-issue-16968-sandbox-permissions
branch
from
a2c9a53 to
7ad1048
Compare
2 participants
Summary
Fixes a 'permission denied' (EACCES) error when running in sandbox mode on Linux distributions like NixOS where the host user's UID is not 1000.
Details
The issue was caused by a UID/GID mismatch between the host user and the container user when mounting the configuration directory.
Key Changes:
/etc/os-release.groupadd -oto support non-unique GIDs (common for GID 1000).id -nu ${uid}for switching viasu.useraddis missing or mapping fails, the container now fails explicitly with a clear error message.Impact on Users
Related Issues
Fixes #16968
How to Validate
npm test -w @google/gemini-cli -- src/utils/sandboxUtils.test.ts src/utils/sandbox.test.ts(46 tests).gemini -s 'Say hello'.Pre-Merge Checklist