{"version":"2.1.223","anchor":"linux-bubblewrap-sandbox-resolves-symlinks-and-expands-deny-","canonical_anchor":"linux-bubblewrap-sandbox-resolves-symlinks-and-expands-deny-","heading":"Linux bubblewrap sandbox resolves symlinks and expands deny-only roots","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223\/e\/linux-bubblewrap-sandbox-resolves-symlinks-and-expands-deny-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223","markdown":"### Linux bubblewrap sandbox resolves symlinks and expands deny-only roots\n\nOn Linux, sandboxed writes land in the right place instead of being wrongly diverted into a temporary overlay.\n\n**What**\n\nThe bubblewrap argument builder tracks bound paths more accurately, so writes are not wrongly redirected into a temporary overlay.\n\n**Details**\n\n- the realpath of each bound directory is also pushed when it differs from the given path\n- a deny-only root is expanded into its top-level children, skipping `proc`, `dev` and `sys`\n- the ssh config drop-in directory is included when present\n- these sets decide whether a would-be write path is already covered before a temporary overlay is created\n- Linux only\n\n**Evidence**\n\n`\/etc\/ssh\/ssh_config.d`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 0\/5"}