{"version":"2.1.323","anchor":"sandbox-deny-list-adds-a-new-config-directory-ca-certificat","canonical_anchor":"sandbox-deny-list-adds-a-new-config-directory-ca-certificat","heading":"Sandbox blocks writes to one more config folder in your home directory","tier":"notice","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/sandbox-deny-list-adds-a-new-config-directory-ca-certificat","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Sandbox blocks writes to one more config folder in your home directory\n\nThe sandbox now blocks writes to another config folder in your home directory and accepts two known versions of a Java certificate script\n\n**Unclear.** Which home config folder was added to the write-blocked list is not stated.\n\n**What**\n\nThe sandbox is the protected space Claude Code can run commands in, with limits on what those commands may touch. Two parts of its setup changed:\n\n- Write-blocked folders: one more config folder in your home directory is now on the list commands in the sandbox may not write to.\n\n- Java certificate script: Claude Code checks `\/var\/lib\/dpkg\/info\/ca-certificates-java.postinst` against known fingerprints, and now accepts two sets of them instead of one.\n\n**Why**\n\nThis affects how the sandbox is set up, most of all on Debian-family Linux systems where that certificate script lives.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}