RomanNum3ral
/
claw-code
mirror of https://github.com/instructkr/claw-code.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(sandbox): add --map-auto flag for unshare commands 

On systems where `unshare --map-root-user` alone fails because uid_map
direct writes are blocked by the kernel (observed on util-linux 2.39.3
with non-root users), adding `--map-auto` lets unshare use the newuidmap
SUID helper with /etc/subuid delegations to set up the mapping.

This affects both the user-namespace detection probe and the actual
sandbox launch arguments. When --map-root-user already works natively,
the additional --map-auto flag is a safe no-op.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Einspanner123 2026-05-10 16:37:16 +08:00 committed by Einspanner123
parent 0581894b7e
commit 2a62441b69
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rust/crates/runtime/src/sandbox.rs
View File

@ -223,6 +223,7 @@ pub fn build_linux_sandbox_command(
let mut args = vec![ let mut args = vec![
"--user".to_string(), "--user".to_string(),
"--map-root-user".to_string(), "--map-root-user".to_string(),
"--map-auto".to_string(),
"--mount".to_string(), "--mount".to_string(),
"--ipc".to_string(), "--ipc".to_string(),
"--pid".to_string(), "--pid".to_string(),
@ -293,7 +294,7 @@ fn unshare_user_namespace_works() -> bool {
return false; return false;
} }
std::process::Command::new("unshare") std::process::Command::new("unshare")
.args(["--user", "--map-root-user", "true"]) .args(["--user", "--map-root-user", "--map-auto", "true"])
.stdin(std::process::Stdio::null()) .stdin(std::process::Stdio::null())
.stdout(std::process::Stdio::null()) .stdout(std::process::Stdio::null())
.stderr(std::process::Stdio::null()) .stderr(std::process::Stdio::null())