[BUG] plugin eval: sandboxed Bash cannot write the run workspace when TMPDIR is under /tmp ("Read-only file system") #104797

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   area:sandbox

   platform:linuxIssue specifically occurs on LinuxIssue specifically occurs on Linux

   has reproHas detailed reproduction stepsHas detailed reproduction steps

   on Oct 24, 2026
2. 6t9xstar commented on Nov 5, 2026

   

   6t9xstar

   on Nov 5, 2026

   More actions

   This error occurs because of an inversion in Linux VFS mount namespace ordering between the sandbox's /tmp isolation and the project directory bind-mount.

   Root Cause

   Most sandboxes isolate /tmp to prevent inter-process host pollution by mounting a fresh tmpfs over /tmp:

   mount("tmpfs", "/tmp", "tmpfs", 0, "mode=1777");

   If your workspace is located at /tmp/eval-123/cwd:

   1. If the sandbox bind-mounts /tmp/eval-123/cwd before masking /tmp with tmpfs, the new tmpfs mount completely shadows and hides the workspace mount, turning writes into errors or sending them into an unmapped tmpfs.
   2. Conversely, if /tmp is remounted read-only (MS_RDONLY) as a security measure, any directory underneath /tmp inherits the read-only flag from the VFS super-block unless explicitly re-bound and remounted MS_BIND | MS_REC.

   The Fix

   To support projects located in /tmp, follow this mount sequence:

   1. Check for Root Equality:

      if project_root != Path::new("/tmp") {
          // Only mount private tmpfs over /tmp if the project itself isn't /tmp
          mount_private_tmpfs("/tmp", "mode=1777")?;
      }

   2. Bind-Mount the CoW Workspace Second:
      Always bind-mount the CoW overlay (or working directory) after the tmpfs for /tmp is configured. If the workspace is inside /tmp, recreate the directory structure inside the new tmpfs before bind-mounting:

      let _ = std::fs::create_dir_all(project_root);
      mount(merged_overlay, project_root, NULL, MS_BIND | MS_REC, NULL)?;

   3. Landlock Ruleset Ordering:
      In your Landlock ruleset, ensure both the project root descriptor and /tmp descriptor are given AccessFs::from_all(abi). When Landlock evaluates path access, having the project root descriptor registered ensures descendant files within the workspace receive explicit write access regardless of ancestor mounts.