[johntmyers]

Summary

Validate filesystem policy paths through open descriptors and reject symlinks beneath workload-modifiable directories. Preserve protected system aliases and return command startup errors promptly over SSH.

Changes

• Validate each path component and reuse its opened descriptor for Landlock rules.
• Fail closed for unsafe symlinks and policies with no usable paths.
• Report SSH startup failures with stderr, a nonzero exit status, and channel closure.
• Add regression coverage and update filesystem policy guidance.

Release Notes

Filesystem policy paths through symlinks inside writable workspaces now fail launch, including in best-effort mode. Specify their target paths directly.

Testing

• 31 Linux Landlock tests passed.
• 70 SSH tests passed.
• 5 Docker end-to-end tests passed.
• Linux Clippy, formatting, and documentation checks passed.
• Musl runtime build passed; musl unit-test compilation encountered existing ioctl and msghdr errors.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant documentation updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5278.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 6484760. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — No explicit risk acceptance found

Filesystem policy paths and included workdirs previously followed valid symlinks; symlinks beneath workload-owned or writable directories now abort launch in both Landlock modes.

• Impact: Existing policies using workspace aliases or symlinked workdirs can prevent sandbox startup and subsequent exec commands, even when other allowed paths remain usable.
• Action: Preserve existing policy-path acceptance in v0.1.8, or defer the restriction to a minor release with the documented target-path migration.
• PR: fix(sandbox): validate filesystem policy anchors #5278

2. policy — No explicit risk acceptance found

landlock.compatibility: best_effort previously continued with baseline-only restrictions when a nonempty effective path list yielded no usable paths; it now aborts launch.

• Impact: Deployments relying on the documented fallback when every effective path is missing or inaccessible now fail startup or exec instead of running.
• Action: Retain the best_effort fallback in v0.1.8, or defer strict admission to a minor release with guidance to provision at least one usable effective path.
• PR: fix(sandbox): validate filesystem policy anchors #5278

Review details

• Execution: complete
• Candidate: PR #5278 (ed3f500cd43c4952fb1b39e08fc61bf7b8f28a1c)
• Baseline: dbc0517a3103a1361194262a70800cf30c8fc939 (dbc0517a3103a1361194262a70800cf30c8fc939)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[johntmyers]

gator-agent

PR Review Status

The independent code review found no blocking findings. The filesystem policy guidance and regression coverage are included. Required checks are still running; the standard E2E suite was rerun on this head after applying test:e2e.

Gator metadata

• Validation: Maintainer-authored sandbox policy validation and SSH startup error fix; project-valid.
• Docs: Published filesystem policy guidance updated under docs/.
• Blocking findings: None.
• Carried findings: None.
• Checks: DCO, vouch, Helm Lint, Trivy Changes, and latest Review Readiness passed; Branch Checks pending. Applied area:runtime to satisfy review routing.
• E2E: test:e2e; Branch E2E Checks run 41909674567, attempt 2, confirmed running on the current head. Mirror is current.
• Head SHA: 64847600977f338e3609a7626a1f26ac40be3832
• Base SHA: dbc0517a3103a1361194262a70800cf30c8fc939
• Merge base SHA: dbc0517a3103a1361194262a70800cf30c8fc939
• Patch ID: 569f031b6392478671c10d5dec4a90f100a4305a
• Gator payload: 13
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — No explicit risk acceptance found

Filesystem policy paths and included workdirs previously followed valid symlinks; symlinks beneath workload-owned or writable directories now abort launch in both Landlock modes.

• Impact: Existing policies using workspace aliases or symlinked workdirs can prevent sandbox startup and subsequent exec commands, even when other allowed paths remain usable.
• Action: Preserve existing policy-path acceptance in v0.1.8, or defer the restriction to a minor release with the documented target-path migration.
• PR: fix(sandbox): validate filesystem policy anchors #5278

2. policy — No explicit risk acceptance found

landlock.compatibility: best_effort previously continued with baseline-only restrictions when a nonempty effective path list yielded no usable paths; it now aborts launch.

• Impact: Deployments relying on the documented fallback when every effective path is missing or inaccessible now fail startup or exec instead of running.
• Action: Retain the best_effort fallback in v0.1.8, or defer strict admission to a minor release with guidance to provision at least one usable effective path.
• PR: fix(sandbox): validate filesystem policy anchors #5278

Review details

• Execution: complete
• Candidate: PR #5278 (ed3f500cd43c4952fb1b39e08fc61bf7b8f28a1c)
• Baseline: dbc0517a3103a1361194262a70800cf30c8fc939 (dbc0517a3103a1361194262a70800cf30c8fc939)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

both are acceptable changes

[johntmyers]

@shiju-nv Both findings are addressed in a597c94. Could you take another look?

• Startup diagnostics use the retained ChannelWriteHalf with a 50 ms timeout, followed by exit status, EOF, and close. Regression coverage exercises receive windows of 0, 8, and 65,536 bytes with a live sibling channel.
• Shell and exec requests now reject main_attached channels. The regression verifies that the existing attachment remains usable and that a new attachment can acquire input after it closes.

Validation: 70 SSH tests, 5 Docker end-to-end tests, Clippy, formatting, and commit-hook checks passed.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. policy — Risk explicitly accepted

filesystem_policy.read_only/read_write and included workdirs previously followed valid symlinks, but now abort launch when a symlink has a workload-owned or writable ancestor.

• Impact: Existing workspace-alias policies and symlinked workdirs can prevent startup and subsequent exec in both Landlock modes, even when other allowed paths remain usable.

• Action: The documented target-path migration and author acceptance address migration and acknowledgment, but v0.1.8 still requires compatible path acceptance or deferral to a minor release.

• PR: fix(sandbox): validate filesystem policy anchors #5278

• Acceptance: comment

2. policy — Risk explicitly accepted

landlock.compatibility: best_effort previously continued with baseline-only restrictions when a nonempty effective path list yielded no usable paths, but now aborts launch.

• Impact: Deployments relying on the documented fallback when every effective path is missing or inaccessible now fail startup or exec instead of running.

• Action: The existing recommendation remains to preserve best_effort fallback in v0.1.8 or defer strict admission to a minor release with guidance to provision at least one usable effective policy path.

• PR: fix(sandbox): validate filesystem policy anchors #5278

• Acceptance: comment

Review details

• Execution: complete
• Candidate: PR #5278 (a17423e6de3ed556a0317b1a43c8be57d8cbb993)
• Baseline: dbc0517a3103a1361194262a70800cf30c8fc939 (dbc0517a3103a1361194262a70800cf30c8fc939)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[johntmyers]

gator-agent

PR Review Status

Thanks @johntmyers, I checked your update against @shiju-nv's two SSH requests. The independent follow-up review found no blocking findings: startup diagnostics now use the retained writer with a 50 ms timeout, and shell/exec requests reject an existing main attachment. The regression tests cover zero and small receive windows with sibling completion, plus continued attachment input and lease reacquisition after close. Tests were inspected during this review; current-head CI is still running.

Both requests are addressed in code. Shiju's human-owned review threads remain open for his confirmation. The earlier acceptance of the filesystem-policy compatibility changes remains in effect.

Blocking findings: None.

Carried Gator findings: None.

Gator metadata

• Validation: Maintainer-authored sandbox policy and SSH startup fix; project-valid.
• Docs: Published filesystem policy guidance updated; this follow-up restores reliable SSH failure handling without a new public configuration surface.
• Checks: DCO, PR Issue Acceptance, Helm Lint, and Trivy Changes passed; Branch Checks pending.
• E2E: test:e2e retained. Current-head Branch E2E Checks run 42243077751, attempt 1, is queued after build progress; required E2E gate pending. No additional dispatch needed.
• Head SHA: a597c947f40e52bc6a704b60c1df07e4036667a3
• Base SHA: dbc0517a3103a1361194262a70800cf30c8fc939
• Merge base SHA: dbc0517a3103a1361194262a70800cf30c8fc939
• Patch ID: 2e765ffb9bfc6b8c9bb2c3be8101a8d76895ac2a
• Gator payload: 13
• Review mode: follow_up
• Previous reviewed SHA: 64847600977f338e3609a7626a1f26ac40be3832
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator reached gator:merge-ready; the existing review history is preserved.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.