Search results

seccomp-notify handler ignores dirfd, fails on relative openat paths

enhancementNew feature or requestNew feature or request

security

Status: Open.

#262 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Restrict /proc, /sys, and /dev access in Linux system groups

enhancementNew feature or requestNew feature or request

security

Status: Open.

#261 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Track Landlock ABI V7 and V8 for future adoption

enhancementNew feature or requestNew feature or request

security

Status: Open.

#260 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Layered Landlock rulesets for kernel-enforced monotonic restriction

enhancementNew feature or requestNew feature or request

security

Status: Open.

#259 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Secure per-session TMPDIR isolation

enhancementNew feature or requestNew feature or request

security

Status: Open.

#258 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Unify path canonicalization with ancestor-walk fallback

enhancementNew feature or requestNew feature or request

security

Status: Open.

#257 In always-further/nono;

· lukehinds opened on Mar 6, 2026

feat: ABI-aware Landlock capability system with symbolic access groups

enhancementNew feature or requestNew feature or request

security

Status: Open.

#256 In always-further/nono;

· lukehinds opened on Mar 6, 2026

feat: Apply Landlock V6 scoping for signal and abstract Unix socket isolation

enhancementNew feature or requestNew feature or request

security

Status: Open.

#255 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Add port_allow to profile JSON NetworkConfig

enhancementNew feature or requestNew feature or request

Status: Open.

#254 In always-further/nono;

· lukehinds opened on Mar 6, 2026

Use --append-system-prompt instead of persisting sandbox context in CLAUDE.md

enhancementNew feature or requestNew feature or request

Status: Open.

#250 In always-further/nono;

· pierres opened on Mar 5, 2026

Add --net-allow flag to disable network proxy filtering per session

enhancementNew feature or requestNew feature or request

Status: Open.

#249 In always-further/nono;

· pierres opened on Mar 5, 2026

Add --exec as a kernel-enforced binary execution allowlist

feature

Status: Open.

#246 In always-further/nono;

· rams3sh opened on Mar 5, 2026