{"version":"2.1.208","anchor":"linux-sandbox-violation-monitor","canonical_anchor":"linux-sandbox-violation-monitor","heading":"Linux sandbox violation monitor","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.208\/e\/linux-sandbox-violation-monitor","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.208","markdown":"### Linux sandbox violation monitor\n\n**What**\n\nWhen running with the Linux sandbox enabled, Claude now starts a Unix-socket observer that monitors for filesystem violations (writes to paths that should be denied). Violations are reported in real time rather than only being caught after the fact.\n\n**Details**\n\n- Creates a temporary socket file under `\/tmp\/srt-obs-*`\n- Receives structured violation events (syscall name, path, command) from the sandbox kernel module\n- Applies `ignoreViolations` filters (by path prefix and by command name)\n- The monitor socket path is passed to the sandbox so it can report outbound writes\n- If the socket fails to start, violation monitoring is disabled but the sandbox itself continues running\n\n**Evidence**\n\nLinux sandbox monitor (search for `\"Started Linux seccomp violation monitor\"` and `\"[Sandbox Linux Monitor]\"`)"}