Refuse launch dirs containing the allowlist's resolved location

README.md

@@ -72,6 +72,8 @@ pod on that network that holds the sandbox's netns, DNS and hosts file.
 - Router-side DNS resolves allowlisted names on the host's resolvers, so
   internal names like `vault.service.consul` work.
 - The home volume persists across sessions and is shared by all of them.
+- Never hard-link the allowlist into a directory you launch from; hardlinks
+  can't be detected by path.
 
 ## Development
 

agent-sandbox

@@ -150,7 +150,7 @@ check_launch_dir() {
   pwd=$(realpath "$PWD")
   home=$(realpath -m "$HOME")
   inside "$home" "$pwd" && die "refusing to mount $pwd: it is or contains \$HOME"
-  for dir in "$CONFIG_DIR" "$(dirname "$ALLOWLIST")"; do
+  for dir in "$CONFIG_DIR" "$(dirname "$ALLOWLIST")" "$(dirname "$(realpath -m "$ALLOWLIST")")"; do
     dir=$(realpath -m "$dir")
     inside "$dir" "$pwd" && die "refusing to mount $pwd: it contains $dir"
   done

tests/test.sh

@@ -97,5 +97,12 @@ ln -s "$work/home" "$work/homelink"
 check launch-refuses-home-symlink "1 none" "$(launch "$work/homelink" AGENT_SANDBOX_ALLOWLIST="$good")"
 check launch-refuses-config-parent "1 none" "$(launch "$work/other" XDG_CONFIG_HOME="$work/other/cfg" AGENT_SANDBOX_ALLOWLIST="$good")"
 check launch-refuses-allowlist-dir "1 none" "$(launch "$work/home/proj" AGENT_SANDBOX_ALLOWLIST="$work/home/proj/hosts")"
+mkdir -p "$work/home/dotfiles" "$work/home/.config/agent-sandbox"
+cp "$good" "$work/home/dotfiles/hosts"
+ln -s "$work/home/dotfiles/hosts" "$work/home/.config/agent-sandbox/allowed-hosts"
+check launch-refuses-symlinked-allowlist-target "1 none" "$(launch "$work/home/dotfiles" XDG_CONFIG_HOME="$work/home/.config")"
+rm "$work/home/.config/agent-sandbox/allowed-hosts"
+ln -s "$work/home/dotfiles" "$work/home/cfglink"
+check launch-refuses-symlinked-config-dir "1 none" "$(launch "$work/home/dotfiles" XDG_CONFIG_HOME="$work/home/cfglink")"
 
 ((fails == 0)) || { echo "$fails failed"; exit 1; }