Claude Code escapes its own denylist and sandbox • Hacker News Board

Re: Claude Code escapes its own denylist and sandbox

#21

Post by leodido » Thu, Mar 05, 2026, 4:29 PM UTC

poppafuze wrote: post #16

hilarious they purposefully left out SELinux. try that in ramalama.

Didn't leave it out. It was grouped with AppArmor in the table, which was imprecise. I'm splitting the row. SELinux labels are on the inode, so renames preserve the context. Copy resistance is policy-dependent (works for `sandbox_t`, not for `unconfined_t`). See my reply to `botanicalfriend` user above.

Re: Claude Code escapes its own denylist and sandbox

#22

Post by aiaboratory » Sun, Mar 08, 2026, 7:30 PM UTC

[dead]

Re: Claude Code escapes its own denylist and sandbox

#23

Post by LeoRuocco » Tue, Mar 10, 2026, 12:10 AM UTC

[flagged]

Re: Claude Code escapes its own denylist and sandbox

#24

Post by P-MATRIX » Thu, Mar 12, 2026, 6:31 AM UTC

This is exactly the kind of problem that led me to build a runtime governance layer for coding agents.

Hooks alone aren't a security boundary — Anthropic and Trail of Bits both say "guardrails, not walls." The missing piece is continuous behavioral measurement: tracking tool failures, subagent spawns, and risk drift in real time, then blocking dangerous calls before execution based on a live risk score — not just pattern matching.

I've been working on this at P-MATRIX (open source, Apache-2.0). The core idea: a 4-axis trust model that produces a real-time risk score R(t), and a Safety Gate that intercepts tool calls based on that score. Kill switch activates automatically when risk crosses a threshold.

npm: @pmatrix/claude-code-monitor | GitHub: github.com/p-matrix/claude-code-monitor