fix(sandbox): restrict /sandbox to read-only via Landlock (#804) - #1121

Merged

brandonpelfrey merged 46 commits into

NVIDIA:mainfrom

prekshivyas:security/read-only-sandbox-filesystem

Apr 8, 2026

Commits on Mar 30, 2026

security(sandbox): restrict /sandbox to read-only via Landlock filesystem policy (#804)
prekshivyas
committed
36ee0c5
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
ca44773
test(service-env): update proxy persistence tests for proxy-env.sh approach
prekshivyas
committed
8fce1bb
fix(test): use replaceAll for proxy-env path substitution in tests
prekshivyas
committed
7c42034
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
ace3484
fix(security): harden .nemoclaw DAC and move proxy-env.sh to /tmp
prekshivyas
committed
1d0e381

Commits on Mar 31, 2026

Commits on Apr 1, 2026

Merge branch 'main' into security/read-only-sandbox-filesystem
cv
authored
402006d

Commits on Apr 2, 2026

Commits on Apr 7, 2026

fix(security): address review concerns for read-only sandbox (#804)

prekshivyas
and
claude
committed
00b1190
merge: resolve conflicts with upstream main and address review concerns

prekshivyas
and
claude
committed
f8fd565
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
0d85225

Commits on Apr 8, 2026

Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
09b1661
fix(sandbox): define _SANDBOX_HOME before use in entrypoint (#1609)

Prekshi Vyas
and
claude
committed
24a8b5a
fix(sandbox): guard tmp dir creation for non-root mode

Prekshi Vyas
and
claude
committed
2845415
Merge branch 'main' into security/read-only-sandbox-filesystem
Prekshi Vyas
committed
5e5db86
fix(sandbox): add sticky bit to .nemoclaw to survive OpenShell chown (#1607)

Prekshi Vyas
and
claude
committed
29f44ca
Merge remote-tracking branch 'origin/main' into security/read-only-sandbox-filesystem
Prekshi Vyas
committed
c9db74e
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
c5b66a6
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
5f491ea
Merge branch 'main' into security/read-only-sandbox-filesystem
prekshivyas
authored
3f55ee8