mxc 0.4.0-aarch64-linux → 0.4.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 40697749dc7afb74546b19dee6b7fd8c5d2ff143a5b041b61bdeb09c32f3c575
-  data.tar.gz: ec0f98019d301ae75674f09a5e0c0f2d713cfe38e558184116cf14da3e1459e4
+  metadata.gz: '019dd4712d55190c3616d7bc558c177fe44a69c1f465eded1897fb3946415f17'
+  data.tar.gz: '0036567429da0f40373e2e6538c44bf6cfa08dc02c6e656e9bc1690b432c1505'
 SHA512:
-  metadata.gz: 3658a7479944d9f1b1527db35cd754c9b8b589f8ec449e307b41df4cdc8ba26b227d4b318c6c63483d16f829ee09be615e50fa82ce7e3537597ef230c437e056
-  data.tar.gz: 1932637c3b54ef4653963507e45dd35c8a4a959728a8e7a63738c9b317792c6daee2c6df3419848ed4b47c39fba994f820c28856b2773f41367ccec63bcffb02
+  metadata.gz: 446f30c7d676a2fd2ab9572167a20f8412a293a90d2f60659ebb75a581309c1aff4c504bfa5d968179f67cfb2ee89870c2d830a455acc09f72515b2c13f22f37
+  data.tar.gz: f2c244717354fd7fe72c644e7faea4566f55eb63a37eada7d03b5498cfa2faae2ff34b16586a79a6cceb7d2ba99fba9f445e111c1cc149d8adbf6cfcb685af77

data/README.md

@@ -128,6 +128,8 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
+A sandbox controls files, network, and resources. It does not always hide other processes: on some backends a command can read their command lines, and on macOS the environment your application started with. [Policies](https://crmne.github.io/mxc/policies/#what-the-command-can-see-of-other-processes) lists what each backend shows.
+
 Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation

data/lib/mxc/sandbox.rb

@@ -177,7 +177,8 @@ module MXC
       add_paths(:readable, paths)
     end
 
-    # Adds paths the command can read and write.
+    # Adds paths the command can read and write. A path that is also #readable is writable,
+    # whichever was added first. A readable path inside a writable one stays read-only.
     def with_writable(*paths)
       add_paths(:writable, paths)
     end
@@ -470,9 +471,11 @@ module MXC
 
     def request(arguments)
       Preflight.check!(network:, denied:, resources:, backend:)
+      readwrite = expand(writable)
       {
-        readonly: expand(readable) | library_files(arguments),
-        readwrite: expand(writable),
+        # MXC resolves a path in both lists to read-only.
+        readonly: (expand(readable) | library_files(arguments)) - readwrite,
+        readwrite:,
         denied: expand(denied) | hidden_resolver_sockets,
         environment:,
         working_directory:,

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: aarch64-linux
 authors:
 - Carmine Paolino
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies: []
 description: An unofficial Ruby binding to Microsoft's MXC. Run commands in Bubblewrap,
   Seatbelt or Windows ProcessContainer sandboxes with filesystem, network, environment