{"version":"2.1.251","anchor":"a-stripped-down-sandbox-configuration-path","canonical_anchor":"a-stripped-down-sandbox-configuration-path","heading":"A stripped-down sandbox configuration path","tier":"soon","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/a-stripped-down-sandbox-configuration-path","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### A stripped-down sandbox configuration path\n\nThe sandbox builder can produce a policy-only mode, but nothing visible switches it on.\n\n**What**\n\nThe sandbox configuration builder gained a mode that suppresses most filesystem grants, leaving a policy-only sandbox. Nothing in the code read for this build shows what turns the mode on.\n\n**Details**\n\n- When active it drops `permissions.additionalDirectories`, allow entries derived from permission rules, and `sandbox.filesystem.allowWrite`\/`allowRead` entries coming from anything other than a policy settings source.\n- It also drops the network fields `allowUnixSockets`, `allowLocalBinding` and `httpProxyPort`.\n\n**Evidence**\n\n`...(u ? [] : e.permissions?.additionalDirectories || [])`\n\n- Area: Sandbox\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}