You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.314,
ImprovementsSection of the release
What
The description of the sandbox excludedCommands setting is more precise now. The sandbox is a fenced-off space where commands run with limited access. The description used to say only that matching command patterns always run outside it.
It now says an entry takes a call out of the sandbox only when every command in the call matches an entry. This includes every part of a pipe or chain. It also lists calls that stay sandboxed:
cd
command substitution, such as $(...)
redirects other than 2>&1, including heredocs
Why
The old wording suggested more commands would escape the sandbox than actually do. If you rely on excludedCommands, check that your pipes, chains and redirects match these rules.
