Re:Claude Code escapes its own denylist and sandbox
by poppafuze on Wednesday March 04, 2026 @09:45PM
(#47256858)
hilarious they purposefully left out SELinux. try that in ramalama.
[ Parent
| on HN ]
Re:Claude Code escapes its own denylist and sandbox
by leodido on Thursday March 05, 2026 @11:29AM
(#47263698)
Didn't leave it out. It was grouped with AppArmor in the table, which was imprecise. I'm splitting the row. SELinux labels are on the inode, so renames preserve the context. Copy resistance is policy-dependent (works for `sandbox_t`, not for `unconfined_t`). See my reply to `botanicalfriend` user above.