docs(security): correct the harness set and record the sandbox decision - #44
Merged
Conversation
SECURITY.md still described the active harness set as "codex and zcode only" and named nddev-zcode-app as a module bootstrap drives. Neither has been true since 2.3.0: zcode is contract-delegated to nddev-harnesses, and bootstrap does not delegate to it at all. The `--no-sandbox` flag is recorded where the browser boundary is stated, so it reads as a boundary decision rather than an unexplained relaxation of one. The prohibition list is unchanged and the flag violates none of it: it is not a skip flag, an alternate executable or endpoint, provider auto-start, a stock browser fallback, or a non-loopback listener. What it does is let the zygote start on the releases whose AppArmor policy leaves it no sandbox to enter. Both instruction surfaces now also say what NOT to do instead - relaxing kernel.apparmor_restrict_unprivileged_userns would trade a host-wide hardening for one headless browser.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation-only follow-up to #43, found while auditing for claims the code no longer supports.
SECURITY.mdwas stale. It still described the active harness set as "codex and zcode only" and namednddev-zcode-appamong the modules bootstrap drives. Neither has been true since 2.3.0: zcode is declaredharnesses.delegatedand owned bynddev-harnesses, and bootstrap does not delegate to it at all.The
--no-sandboxflag is now a recorded decision. Both instruction surfaces state why it exists, that it is Linux-only, and what must not be done instead. The browser prohibition list is unchanged, and the flag violates none of it - it is not a skip flag, an alternate executable or endpoint, provider auto-start, a stock browser fallback, or a non-loopback listener. Relaxingkernel.apparmor_restrict_unprivileged_usernsis called out explicitly as the wrong fix: it would trade a host-wide kernel hardening for one headless browser.python3 -m pytestscripts/ci/validate.shci-validate-ok