Unclear What this switch does when the server sends nothing is not settled, so it is unclear whether the new handling applies to you by default.
What
In the sandbox, denyWrite lists places commands may not write to. A symlink is a file that points at another location. Before, the sandbox always followed a symlink in that list, up to 8 hops, and protected wherever it ended up. Behind a server-controlled switch, it now handles them differently:
- A symlink that points at another host, or that cannot be checked without following it, is not followed. The sandbox logs this and keeps protecting the symlink's own path.
- Symlinks that have been replaced get a new decision: follow, keep or refuse.
- Symlinks that point at nothing are also handled differently.
Why
This closes a way of redirecting a write-protection rule to somewhere else by changing where a symlink points.
Names in the bundledenyWrite
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
What this switch does when the server sends nothing is not settled, so it is unclear whether the new handling applies to you by default.