{"version":"2.1.323","anchor":"linux-sandbox-allowwithindeny-paths-stay-writable-inside-a","canonical_anchor":"sandbox-allowwithindeny-support-and-linux-monitor-exemption","heading":"Sandbox supports allowWithinDeny paths inside denied areas","tier":"use","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/linux-sandbox-allowwithindeny-paths-stay-writable-inside-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Sandbox supports allowWithinDeny paths inside denied areas\n\nSandbox rules can re-allow a path inside a denied folder with `allowWithinDeny`, enforced on Linux and shown in the permission dialog\n\n**Unclear.** It is not stated which setting fills the `allowWithinDeny` list, so it is unclear how to use it.\n\n**What**\n\nThe sandbox limits which files commands run by Claude can read or write. It now supports `allowWithinDeny`, a list of paths that stay allowed even though they sit inside a denied area.\n\n- Linux enforcement: on Linux and WSL, the sandbox keeps each `allowWithinDeny` path writable inside a folder whose writing is denied. Before, a write deny made everything beneath it read-only. If an entry cannot be kept writable, a message is logged.\n\n- Violation reports: the Linux monitor that reports sandbox breaches no longer flags writes to a path covered by an `allowWithinDeny` entry.\n\n- Permission dialog: a new dim line, \"Allowed within denied:\", lists these paths next to the existing deny-within-allow list.\n\n- Commit secrets prompt: the Bash prompt that warns about committing secrets now lists `.claude\/settings.local.json`.\n\n**Why**\n\nYou can block writes to a whole folder while keeping one narrow path inside it writable. The dialog shows these exceptions so you can check what the sandbox actually permits.\n\n- Area: Sandbox\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}