From 07d93b0fe19f5d9c8caf5dac72cfe591bee932b2 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:51:11 +1100
Subject: [PATCH] Refuse launch dirs containing the allowlist's resolved
 location

---
 README.md     | 2 ++
 agent-sandbox | 2 +-
 tests/test.sh | 7 +++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8f29076..a29c172 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,8 @@ pod on that network that holds the sandbox's netns, DNS and hosts file.
 - Router-side DNS resolves allowlisted names on the host's resolvers, so
   internal names like `vault.service.consul` work.
 - The home volume persists across sessions and is shared by all of them.
+- Never hard-link the allowlist into a directory you launch from; hardlinks
+  can't be detected by path.
 
 ## Development
 
diff --git a/agent-sandbox b/agent-sandbox
index 3a12b5b..e2a10b4 100755
--- a/agent-sandbox
+++ b/agent-sandbox
@@ -150,7 +150,7 @@ check_launch_dir() {
   pwd=$(realpath "$PWD")
   home=$(realpath -m "$HOME")
   inside "$home" "$pwd" && die "refusing to mount $pwd: it is or contains \$HOME"
-  for dir in "$CONFIG_DIR" "$(dirname "$ALLOWLIST")"; do
+  for dir in "$CONFIG_DIR" "$(dirname "$ALLOWLIST")" "$(dirname "$(realpath -m "$ALLOWLIST")")"; do
     dir=$(realpath -m "$dir")
     inside "$dir" "$pwd" && die "refusing to mount $pwd: it contains $dir"
   done
diff --git a/tests/test.sh b/tests/test.sh
index 4480537..fd55bfb 100755
--- a/tests/test.sh
+++ b/tests/test.sh
@@ -97,5 +97,12 @@ ln -s "$work/home" "$work/homelink"
 check launch-refuses-home-symlink "1 none" "$(launch "$work/homelink" AGENT_SANDBOX_ALLOWLIST="$good")"
 check launch-refuses-config-parent "1 none" "$(launch "$work/other" XDG_CONFIG_HOME="$work/other/cfg" AGENT_SANDBOX_ALLOWLIST="$good")"
 check launch-refuses-allowlist-dir "1 none" "$(launch "$work/home/proj" AGENT_SANDBOX_ALLOWLIST="$work/home/proj/hosts")"
+mkdir -p "$work/home/dotfiles" "$work/home/.config/agent-sandbox"
+cp "$good" "$work/home/dotfiles/hosts"
+ln -s "$work/home/dotfiles/hosts" "$work/home/.config/agent-sandbox/allowed-hosts"
+check launch-refuses-symlinked-allowlist-target "1 none" "$(launch "$work/home/dotfiles" XDG_CONFIG_HOME="$work/home/.config")"
+rm "$work/home/.config/agent-sandbox/allowed-hosts"
+ln -s "$work/home/dotfiles" "$work/home/cfglink"
+check launch-refuses-symlinked-config-dir "1 none" "$(launch "$work/home/dotfiles" XDG_CONFIG_HOME="$work/home/cfglink")"
 
 ((fails == 0)) || { echo "$fails failed"; exit 1; }