open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

docs(llm-security): recover the Windows sandboxing guidance stranded at the split

Browse source 
catalog found commit 0b795b1 sitting on `feat/add-ms-ai-architect` in the
marketplace forge -- a monorepo-path docs commit
(`plugins/llm-security/README.md`) that was only partially carried across
the repo split. Their read was that the CVE reference and
`transfer.fsckObjects` were rewritten into main independently while the
Windows half was never brought over.

Verified here before acting: `AppContainer`, `Windows Sandbox` and
`AppArmor` each grep 0 in our README and 0 at the published v7.8.3 tag,
while `CVE-2024-32002` and `transfer.fsckObjects` are present. Partial
transfer confirmed, not a deliberate drop.

Recovers the three missing pieces:
  - the per-platform sandbox matrix, including the Ubuntu 24.04+ AppArmor
    caveat that explains why bwrap fails there
  - the Windows options table (Windows Sandbox / Docker Desktop / WSL2 /
    AppContainer) with isolation level and requirements
  - the note on why Node's --permission model does not apply: it restricts
    fs access within the Node process and does not sandbox child
    processes, and git is a separate OS process

The layer table already in main is kept as-is -- it postdates the stranded
commit and is more accurate than the version there. Only the one-line
Windows sentence is replaced.

All 8 external links verified live (HTTP 200) rather than copied forward
on trust.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KJxU3xuwfMq8W1mxtiGhLk
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 20:38:29 +02:00
commit 30dba2a457
1 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

23
README.md
View file

@ -189,7 +189,28 @@ Each layer is independent. A failure in one (e.g. an injection that slips past t
| Pre-LLM injection strip | `content-extractor.mjs` produces a structured JSON evidence package; `[INJECTION-PATTERN-STRIPPED]` markers are confirmed findings | Agents never see raw poisoned files from untrusted repos |
| Post-clone size cap | 100 MB max | Resource-exhaustion attacks |
Windows has no kernel-level sandbox equivalent. Run Claude Code inside WSL2 or Docker Desktop for full coverage; the git config hardening alone is sufficient against all known `.gitattributes` attack vectors.
**Where the OS sandbox layer actually holds:**
| Platform | Sandbox | How it works | Limitations |
|----------|---------|--------------|-------------|
| **macOS** | [`sandbox-exec`](https://keith.github.io/xcode-man-pages/sandbox-exec.1.html) | Seatbelt profile restricts file writes to only the per-clone temp dir | Deprecated by Apple but still functional; no replacement exists |
| **Linux** | [`bubblewrap`](https://github.com/containers/bubblewrap) (bwrap) | Read-only root bind mount + writable clone dir + namespace isolation | Requires the `bwrap` package. Works on Fedora/Arch; [fails on Ubuntu 24.04+](https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007) without admin AppArmor configuration |
| **Windows** | None available | Git config hardening only (layer 1) | See the Windows options below |
Sandbox availability is probe-tested at runtime. When none is available the plugin logs a WARN and proceeds with git config hardening only.
**Windows guidance:** Windows ships no CLI-level filesystem sandbox equivalent to `sandbox-exec` or `bwrap`. Every alternative needs either extra software or admin privileges:
| Option | Isolation level | Requirements |
|--------|-----------------|--------------|
| [Windows Sandbox](https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview) | Full VM (Hyper-V) | Windows Pro/Enterprise with Hyper-V enabled. GUI-oriented, not scriptable |
| [Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/) | Container | Docker install. Best option for automated isolation |
| [WSL2](https://learn.microsoft.com/en-us/windows/wsl/install) | Linux VM | WSL2 install. `bwrap` is available inside it, subject to the Ubuntu 24.04+ caveat above |
| [AppContainer](https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation) | Process sandbox | A native C++ helper binary — not practical to ship in a Node.js plugin |
Run Claude Code inside WSL2 or Docker Desktop for full coverage. The git config hardening alone is sufficient against all known `.gitattributes` attack vectors on every platform.
> **Why not Node.js `--permission`?** Node's [permission model](https://nodejs.org/api/permissions.html) restricts `fs` access *within* the Node process. It does not sandbox child processes, and `git` runs as a separate OS process — so it does not address this threat at all.
---