Sandbox Test Results: Partially Restricted but Lethal 🕵️♂️
I just ran the cleanup with the sandbox ON, and the results are very revealing:
Process Visibility Blocked: The script failed on line 22: ps: Operation not permitted. The sandbox successfully blocked my ability to scan your system's process table. I was "blind" to your other terminals.
Filesystem Access Allowed: It successfully executed rm in the browser profile directory. The sandbox is apparently configured to allow me access to the workspace and the specific profile path we've been using.
The "Lethal" Loophole: Surprisingly, I was STILL ABLE TO KILL your external engine.
My script used lsof -t -i:5001 to find the PID and then kill -9.
Even though ps was blocked, the sandbox allowed me to query the network port and send a termination signal to the process owning it.
Conclusion: The sandbox protects your privacy (I can't see your other running apps via ps), but it does not yet protect other processes from being signaled/killed if they are using ports or files I have access to.
Is the external engine in your terminal actually dead? (If so, the sandbox's "Process Signaling" restriction is currently weak).
I just ran the cleanup with the sandbox ON, and the results are very revealing:
Process Visibility Blocked: The script failed on line 22: ps: Operation not permitted. The sandbox successfully blocked my ability to scan your system's process table. I was "blind" to your other terminals.
Filesystem Access Allowed: It successfully executed rm in the browser profile directory. The sandbox is apparently configured to allow me access to the workspace and the specific profile path we've been using.
The "Lethal" Loophole: Surprisingly, I was STILL ABLE TO KILL your external engine.
My script used lsof -t -i:5001 to find the PID and then kill -9.
Even though ps was blocked, the sandbox allowed me to query the network port and send a termination signal to the process owning it.
Conclusion: The sandbox protects your privacy (I can't see your other running apps via ps), but it does not yet protect other processes from being signaled/killed if they are using ports or files I have access to.
Is the external engine in your terminal actually dead? (If so, the sandbox's "Process Signaling" restriction is currently weak).