[shahar1]

Summary

• Linux allowAllUnixSockets is undocumented and unguarded.
  • On Linux the sandbox's seccomp filter blocks AF_UNIX, unless sandbox.network.allowAllUnixSockets is true. The container gateway and ssh-agent need it, because allowUnixSockets only applies on macOS.
  • With the flag on and deny-only reads, sandboxed code can reach host sockets that run code outside the sandbox: /run/docker.sock, Docker Desktop's /run/docker-cli.sock, all of /run/user/<uid> (D-Bus and systemd/private, i.e. systemd-run --user), /run/dbus, X11, and on WSL /run/WSL interop and /mnt/wslg.
  • This PR documents the flag and pairs it with sandbox.filesystem.denyRead entries for those paths, and names AF_VSOCK as the residual risk denyRead cannot hide. It also makes verify check 12c Linux-consistent and adds a check 12e that requires the socket denyRead coverage whenever the flag is on, even when check 12 is otherwise n/a. Install Step L.3 and tools/sandbox-lint get matching rules and tests.
• A parent allowRead makes the project read-only. An allowRead entry that is a strict parent of an allowWrite path makes bubblewrap mount the write path read-only. Every Bash call then fails with bwrap: Can't create file … Read-only file system. This PR adds a troubleshooting entry, a sandbox-error-hint.sh pattern, and a sandbox-lint rule.
• Placeholders show up in git status. A troubleshooting entry explains why write-protected paths that do not exist appear as character devices 1,3 and are listed as untracked.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Python package (tools/*/ with pyproject.toml)
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)

Test plan

• prek run --all-files --skip workspace-pytest passes
• prek run workspace-pytest --from-ref upstream/main --to-ref HEAD passes; tools/sandbox-lint pytest and the agent-isolation test_sandbox_error_hint.py pass. New tests cover:
  • the socket rule: uid matching against os.getuid(), plus ~ and relative entries;
  • the parent rule: ~, a trailing slash, and .;
  • the hint pattern: a path with a space, and precedence over the /tmp hint.
• Eval suite, skill-eval --cli "claude -p" tools/skill-evals/evals/setup-isolated-setup-verify/: 23/28 pass.
  • 4 of the 5 failures also fail on unmodified upstream/main (step-1 case-7; step-2 case-3, case-5, case-6).
  • The new step-1 case-23-linux-all-unix-sockets-exposed passed 3 of 4 runs.
• Checked on a WSL2 host:
  • With the flag on and the denyRead entries added, the host sockets are no longer sockets inside the sandbox (test -S is false).
  • The gateway sockets and an ssh-agent under /tmp keep working: docker version through the gateway and ssh-keygen -Y sign both succeed.
  • The parent-allowRead failure was reproduced and fixed by listing the specific directories.
  • Claude Code skips absent denyRead paths, so listing paths that a host lacks is harmless.
• Reviewed by an independent agent. Its requested changes are in the second commit.

RFC-AI-0004 compliance

• Sandbox — closes host-socket reach from the sandbox on Linux; no new host access
• Vendor neutrality — placeholders only (check-placeholders passes)

Notes for reviewers (optional)

• Not verified: on Linux, whether a single-socket allowRead inside a denied /run/user/<uid> re-opens an agent socket that lives there. The doc marks it as unverified.
• The root cause of the parent-allowRead trap is Claude Code's mount ordering, so it may also be worth an upstream Claude Code report. The lint rule fails closed, including outside denyRead.
• Companion PR fix(setup): make isolated-setup-verify checks catch false passes #1808 also adds step-1 eval cases (up to case-22, so this one is case-23) and touches the same README case counts. Whichever merges second needs a trivial rebase.

Generative AI: drafted with Claude Code (Claude Opus 5.5) and checked by an independent Claude Opus review agent; opened as a draft for the author's line-by-line review before it is marked ready.

🤖 Generated with Claude Code

[potiuk]

Thanks, this closes a real hole: on Linux the flag silently turns every visible socket into a way out, and the docs, verify 12e and sandbox-lint now say so in the same terms.

I rebased it onto main (conflicts in the troubleshooting table, test_validator.py, and the generated stamps/fingerprint) and added one small fixup: the jsonc example now says to replace <uid> with id -u. Pasted literally, /run/user/<uid> would deny nothing, and it's the entry that stops systemd-run --user.

One non-blocking question for a follow-up: the example names ~/.claude/settings.local.json as a per-machine file. I'm not sure Claude Code reads a user-scope settings.local.json (the documented local file is the project's .claude/settings.local.json). If it doesn't, the Linux half would silently not apply from there.

---

Drafted-by: Claude Code (Opus 5.5); reviewed by @potiuk before posting