Table of Contents
🌏 中文版
The permission layer decides whether a command has authority to run. An authorized process may still inherit broad host access, so Rivumi can wrap configured local command and verification paths in an operating-system sandbox.
One profile, platform-specific wrappers
resolve_command_sandbox() accepts the verification profile and auto, bubblewrap, or Landlock backends. Workspace and task-home roots are readable; configured workspace/task roots are writable.
On macOS, auto generates a sandbox-exec profile with deny-default behavior, required process and metadata access, bounded system reads, and explicit workspace writes. It does not add a network allow rule.
On Linux, auto prefers bubblewrap. The wrapper uses namespace isolation, a new session, read-only and writable binds, and a private /tmp. The Landlock alternative sets no_new_privs, applies filesystem restrictions, installs architecture-specific seccomp restrictions, and only then executes the target argv.
Missing enforcement fails closed
An explicitly requested but unavailable backend does not silently degrade to bare execution. Rivumi returns an error projected as exit 126, and policy-setup failure occurs before exec. This makes sandbox availability observable rather than leaving configuration and actual enforcement out of sync.
The boundary is intentionally narrower than a VM. It covers configured local command and verification paths, not the Rivumi Python process, external coding CLIs, MCP servers, LSP processes, TUI sidecars, or remote runtimes. Kernel and architecture support also constrain Landlock and seccomp. The next article examines ordering, concurrency, and file rollback above this execution layer.
References
Loading...