isaaccladandClaude Opus 4.8 d54ae879b6 Jailed terminal: per-session passwd so customers can't enumerate tenants ...

The jail's /etc/passwd listed every hosting username (no passwords — shadow isn't
in the jail — but it enumerated tenants). The launcher now binds a per-session
/etc/passwd|group (root + the current user only) inside each session's mount
namespace, and the shared jail passwd no longer carries hosting users.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-27 07:22:47 +00:00

..

ladill-jailsh

Jailed terminal: per-session passwd so customers can't enumerate tenants

2026-06-27 07:22:47 +00:00

setup-terminal-jail.sh

Jailed terminal: per-session passwd so customers can't enumerate tenants

2026-06-27 07:22:47 +00:00