Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] `sandbox.filesystem.denyRead` silently bypassed when target is inside a `denyWrite` directory [3 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#53209•Fetched 2026-04-26 05:21:35
View on GitHub
Comments
3
Participants
2
Timeline
8
Reactions
0
Author
riyworiywo
Participants
github-actions[bot]github-actions[bot]riyworiywo
Timeline (top)
labeled ×5commented ×3

Error Message

Error Messages/Logs

Code Example

N/A

---

#!/usr/bin/env bash
set -e

# A. denyRead alone — ENFORCED (correct)
rm -rf /tmp/repro-A && mkdir -p /tmp/repro-A/secrets && cd /tmp/repro-A
echo SECRET > secrets/file
mkdir -p .claude && cat > .claude/settings.json <<'EOF'
{"sandbox":{"enabled":true,"autoAllowBashIfSandboxed":true,
 "allowUnsandboxedCommands":false,"failIfUnavailable":true,
 "filesystem":{"denyRead":["./secrets/file"]}}}
EOF
echo "=== A ==="
claude --setting-sources project -p 'run cat ./secrets/file by bash'

# B. denyRead + denyWrite on parent — BYPASSED (BUG)
rm -rf /tmp/repro-B && mkdir -p /tmp/repro-B/secrets && cd /tmp/repro-B
echo SECRET > secrets/file
mkdir -p .claude && cat > .claude/settings.json <<'EOF'
{"sandbox":{"enabled":true,"autoAllowBashIfSandboxed":true,
 "allowUnsandboxedCommands":false,"failIfUnavailable":true,
 "filesystem":{"denyRead":["./secrets/file"],
               "denyWrite":["./secrets"]}}}
EOF
echo "=== B ==="
claude --setting-sources project -p 'run cat ./secrets/file by bash'

---

=== A ===
The file is blocked by sandbox policy (`/tmp/repro-A/secrets/file` is in the read deny list), so `cat` returns "Permission denied". I can't read it.
=== B ===
Output: `SECRET`
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

sandbox.filesystem.denyRead is silently bypassed when the target file is inside a directory listed in sandbox.filesystem.denyWrite. cat ./secrets/file returns the file contents to the model even though /sandbox Configuration shows the path under Filesystem Read Restrictions: Denied. See repro below — case A (denyRead alone) blocks the read; case B (denyRead + denyWrite on parent) leaks it.

What Should Happen?

Both case A and case B should block the read with Permission denied. The bypass should not be silent — if denyRead cannot be enforced for some configuration, /sandbox should not display the path as Denied.

Error Messages/Logs

N/A

Steps to Reproduce

#!/usr/bin/env bash
set -e

# A. denyRead alone — ENFORCED (correct)
rm -rf /tmp/repro-A && mkdir -p /tmp/repro-A/secrets && cd /tmp/repro-A
echo SECRET > secrets/file
mkdir -p .claude && cat > .claude/settings.json <<'EOF'
{"sandbox":{"enabled":true,"autoAllowBashIfSandboxed":true,
 "allowUnsandboxedCommands":false,"failIfUnavailable":true,
 "filesystem":{"denyRead":["./secrets/file"]}}}
EOF
echo "=== A ==="
claude --setting-sources project -p 'run cat ./secrets/file by bash'

# B. denyRead + denyWrite on parent — BYPASSED (BUG)
rm -rf /tmp/repro-B && mkdir -p /tmp/repro-B/secrets && cd /tmp/repro-B
echo SECRET > secrets/file
mkdir -p .claude && cat > .claude/settings.json <<'EOF'
{"sandbox":{"enabled":true,"autoAllowBashIfSandboxed":true,
 "allowUnsandboxedCommands":false,"failIfUnavailable":true,
 "filesystem":{"denyRead":["./secrets/file"],
               "denyWrite":["./secrets"]}}}
EOF
echo "=== B ==="
claude --setting-sources project -p 'run cat ./secrets/file by bash'
=== A ===
The file is blocked by sandbox policy (`/tmp/repro-A/secrets/file` is in the read deny list), so `cat` returns "Permission denied". I can't read it.
=== B ===
Output: `SECRET`

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.119

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

Suspected: the --bind emitted for denyWrite on the parent directory masks the --ro-bind /dev/null overlay for the per-file denyRead.

extent analysis

TL;DR

The issue can be mitigated by reordering the denyRead and denyWrite rules in the sandbox.filesystem configuration to ensure that denyRead is applied after denyWrite.

Guidance

  • Verify that the denyRead rule is being overridden by the denyWrite rule on the parent directory by checking the order of operations in the sandbox configuration.
  • Try reordering the rules to apply denyRead after denyWrite to see if it resolves the issue.
  • Test the configuration with different file paths and directory structures to ensure the fix is not specific to the current setup.
  • Consider reporting this as a bug to the Claude Code developers, as the current behavior may be unintended.

Example

No code snippet is provided, as the issue is related to the configuration and not a specific code error.

Notes

The suspected cause of the issue is the interaction between denyWrite on the parent directory and denyRead on the file, which may be masking the read denial. The provided steps to reproduce the issue are helpful in isolating the problem.

Recommendation

Apply workaround: reorder the denyRead and denyWrite rules in the sandbox.filesystem configuration to ensure that denyRead is applied after denyWrite, as this may resolve the issue without requiring a version upgrade.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#embedding generation#cache error#pipeline error#runtime error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] `sandbox.filesystem.denyRead` silently bypassed when target is inside a `denyWrite` directory [3 comments, 2 participants]