akitaonrails/ai-jail v1.19.2

on GitHub

Fixed

• getifaddrs() works again inside a networked sandbox. The seccomp filter
  denied every SOCK_RAW socket, which also caught
  socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) — how libc enumerates local
  interfaces. Anything calling it failed with EPERM, and opencode web
  crashed outright instead of falling back to localhost. The carve-out is
  deliberately narrow: that one netlink protocol, only when the sandbox already
  has unrestricted network, never under --lockdown. Every other netlink
  protocol and every other raw socket domain stays denied, so lockdown's
  /sys/class/net mask cannot be walked around. Reported by @wtf9880, with the
  security constraint identified by @pqitr (#118).
• NixOS commands resolve without an absolute path. /run is always a
  private tmpfs, so the system profile at /run/current-system/sw/bin was
  hidden and ai-jail bash failed with No such file or directory. That
  directory is now restored read-only, which also leaves a usable PATH inside
  the sandbox. Thanks to @wtf9880 (#117, #119).
• PATH no longer advertises directories the sandbox does not have. The
  host's PATH describes the host's layout, so under private home entries such
  as ~/.local/share/mise/installs/... dangled: tools looked installed and
  resolved to nothing. Entries that do not exist inside the sandbox are now
  dropped, answering the open question in #113.

Security

• A group-writable Nix store now requires the sticky bit. The store check
  accepted root:nixbld mode 0775, where a group member can delete and
  replace files including bwrap. Mode 1775 — the standard multi-user layout
  — is still trusted, because the sticky bit stops a member replacing someone
  else's paths. Thanks to @pqitr (#115).

Internal

• CI now runs nix flake check, so the Nix build path is verified before
  release instead of by users afterwards. It had no coverage at all, which is
  how v1.19.0 shipped refusing its own bwrap.

Checksums (SHA256)

0d74a048fe3b11af2a482894674e96002606efcc5483bd7663abb46d61945523  ai-jail-linux-x86_64.tar.gz
bee0aaa6f2d6ac10f184b3b9ea96844da61d8c5843853ebe3f944900b1b1a643  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail