mirror of
https://github.com/Hmbown/DeepSeek-TUI.git
synced 2026-09-03 06:50:13 +08:00
084da4dd79
The startup hardening's PR_SET_NO_NEW_PRIVS is inherited by every child
process and is irreversible, so applying it unconditionally broke sudo,
su, and setuid helpers for wheel-group administrators who run Codewhale
over ssh and want the model to be able to escalate (v0.8.65 worked,
v0.9.7 did not).
CODEWHALE_NO_NEW_PRIVS with any falsey value ("", 0, false, no, off,
disabled — the workspace env convention from docs/CONFIGURATION.md)
skips exactly this one prctl, before any thread exists, and logs the
skip at info on the sandbox target. Every other value keeps the default
hardened posture, so the opt-out cannot be entered by a typo. The other
two measures (PR_SET_DUMPABLE=0, RLIMIT_CORE=0) are never skipped.
Verified: cargo test -p codewhale-tui --lib sandbox::process_hardening
(4/4) covers the value table, case/whitespace folding, truthy and
garbage rejection, and the env-var wiring; clippy -D warnings clean.