Repository navigation
linux: bind a deny path that another sandbox makes while the wrap is looking - #618
Merged
Merged
Conversation
…looking An absent deny path is blocked by a mount point that bubblewrap makes on the host. The wrap looks whether the path exists and then whether a component of it is a file, since nothing can be created beneath a file (a worktree's `.git`). That second look included the path itself. Two processes wrapping in one project deny the same absent paths, so one's bubblewrap can make its empty file there between the two looks; the path then counted as lying beneath a file and got no bind at all, for the whole command. The second look now asks about what lies above the path.
ronleizrowice-ant
enabled auto-merge
September 28, 2026 19:01
dylan-conway
approved these changes
Sep 28, 2026
Closed
8 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Linux an absent
denyWritepath is blocked by an empty file ("mount point") that bubblewrap makes on the host. While building the binds, the wrap asks whether the path exists, and then whether any existing component of it is a file, because nothing can be created beneath a file (a worktree's.gitfile, so.git/hooksneeds no deny).That second question included the path itself. Two processes wrapping in one project deny the same absent paths (the dotfiles of the working directory), so one's bubblewrap can make its empty file there between the two questions. The path then counted as lying beneath a file and got no bind at all, for the whole command.
What changes
One line: the second question is asked of what lies above the path (
path.dirname). A path that has become a file meanwhile is bound over with/dev/null, like any other.Who sees a difference
Nobody, except in that race. A path beneath a real file is still left alone.
Testing
New
test/sandbox/deny-path-made-meanwhile.test.ts: the file is made between the two looks (a spy onexistsSync), and the wrap must still bind over it; it fails without the change. The worktree case is pinned beside it. Independent of every other open PR; it touches a line that #584 also rewrites around, so whichever lands second keepspath.dirname.