Fix Permission denied for sandbox user JSON access (Issue #46)#48
Merged
Fix Permission denied for sandbox user JSON access (Issue #46)#48
Conversation
Adding CLAUDE.md with task information for AI processing. This file will be removed when the task is complete. Issue: #46
…46) The realpath fix from v1.3.5 (PR #47) resolved the "No such file or directory" error but introduced a new failure: "Permission denied". Root cause: The GitHub Actions workspace root (/home/runner/work/sandbox/sandbox/) is owned by 'runner' with mode 750. The 'sandbox' user is not in the 'runner' group, so even with o+rx on the data/ subdirectory, the kernel path traversal check fails at the workspace root — EACCES before it can even see the file. Fix: copy the JSON file to /tmp (mode 1777, world-accessible) before running the sandbox user subprocess, then copy the result back. This avoids any need for sandbox to traverse runner-owned workspace directories entirely. Ref: CI run 22263724056, job 64405913545 See: docs/case-studies/issue-46/CASE-STUDY.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
konard
changed the title
This file was added by the issue solver system for task context. Per the commit message, it should be removed when the task is complete. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Member
Author
🤖 Solution Draft LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost estimation:
Now working session is ended, feel free to review and add any feedback on the solution draft. |
Member
Author
✅ Ready to mergeThis pull request is now ready to be merged:
Monitored by hive-mind with --auto-restart-until-mergeable flag |
konard
added a commit
that referenced
this pull request
Feb 21, 2026
The release workflow uses changesets to bump VERSION automatically. Adding a changeset file instead of bumping VERSION manually to follow the established pattern (as done in PRs #47, #48, etc.). Reverts VERSION from 1.3.7 back to 1.3.6 (will be bumped by changeset automation on merge to main). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the second CI failure for issue #46 — "Permission denied" when the sandbox user reads the JSON measurements file.
Root cause: The GitHub Actions workspace root (
/home/runner/work/sandbox/sandbox/) is owned byrunnerwith permissions750. Thesandboxuser is not in therunnergroup, so the kernel path traversal check fails at the workspace root withEACCES— even after the v1.3.5 fix grantedo+rxon the immediatedata/subdirectory.Two-failure chain:
No such file or directorysu - sandboxchanges CWD to/home/sandbox, relative path resolves wrongrealpathto convert to absolute pathPermission denied/home/runner/work/sandbox/sandbox/has mode750, blocks sandbox user from traversal/tmp/(mode1777) before sandbox subprocessFix (v1.3.6): Copy the JSON measurements file to
/tmp/before executingsu - sandbox, then copy the results back./tmpis world-accessible (1777), so the sandbox user can read and write it without needing to traverse any runner-owned directories.Changes
scripts/measure-disk-space.sh: Replacechmod o+rw/o+rxapproach with/tmpcopy approachdocs/case-studies/issue-46/CASE-STUDY.md: Document the second failure and its root cause.changeset/fix-sandbox-user-permission-denied.md: Changeset for patch version bumpFixes #46
🤖 Generated with Claude Code