mxc 0.4.0-x86_64-linux → 0.4.1-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a67f6e03b5528954d3960d5ecee562df2477e4eb35cd2201be7587172f55fde7
-  data.tar.gz: 4fe1e1c493013e84c4db05042647a2bdf52f1fffce6bc0dd0848b56ade99fa64
+  metadata.gz: e823dba4eda34547c8d9f69f757159853a4a7dcfbe4c812977d017aeffab9bad
+  data.tar.gz: '0249efbddc710c8633c134eb7ae6efb82f91855a52c7e55b5f784282d49e15a8'
 SHA512:
-  metadata.gz: dbbdf78fafbea341eb3ef4eaae54059456f89c376d12e836af77a89859726b397dfc67141305e5833c954958f73250442cfc700080c8346610a9d6487c2b3927
-  data.tar.gz: 41f99e3b573d98da712a2d63a86a4fb2754a81dac6106c9aa96dcef5d69b5ec2a11196ca7b9e32d41f27c29223688feae3ef774d04df4612bc776ea1868cdd25
+  metadata.gz: 7f070db2714abec61e97ac6f88787c0a07f5bb2add5bd6596dcbe6e44a7b77502f849fdaeb9dab2ec253069a3b5877b3e48e73df6935ef61b6369c923f64a355
+  data.tar.gz: 622128cab7fced35b66d24348b5d8036b7e175859c984e1147662f2fd42d8293c390a9e683ff2faee5acefd5d4f1e0efc954e1622db7744786d20525c223adf4

data/README.md

@@ -128,6 +128,8 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
+A sandbox controls files, network, and resources. It does not always hide other processes: on some backends a command can read their command lines, and on macOS the environment your application started with. [Policies](https://crmne.github.io/mxc/policies/#what-the-command-can-see-of-other-processes) lists what each backend shows.
+
 Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation

data/lib/mxc/sandbox.rb

@@ -177,7 +177,8 @@ module MXC
       add_paths(:readable, paths)
     end
 
-    # Adds paths the command can read and write.
+    # Adds paths the command can read and write. A path that is also #readable is writable,
+    # whichever was added first. A readable path inside a writable one stays read-only.
     def with_writable(*paths)
       add_paths(:writable, paths)
     end
@@ -470,9 +471,11 @@ module MXC
 
     def request(arguments)
       Preflight.check!(network:, denied:, resources:, backend:)
+      readwrite = expand(writable)
       {
-        readonly: expand(readable) | library_files(arguments),
-        readwrite: expand(writable),
+        # MXC resolves a path in both lists to read-only.
+        readonly: (expand(readable) | library_files(arguments)) - readwrite,
+        readwrite:,
         denied: expand(denied) | hidden_resolver_sockets,
         environment:,
         working_directory:,

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: x86_64-linux
 authors:
 - Carmine Paolino
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies: []
 description: An unofficial Ruby binding to Microsoft's MXC. Run commands in Bubblewrap,
   Seatbelt or Windows ProcessContainer sandboxes with filesystem, network, environment