fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox

ompatel-aiml · ompatel-aiml · commit 12627ad8db42 · 2026-06-30T14:49:10.000-04:00
Remove ~/.gitconfig from the file-write* allow list in all six macOS Seatbelt
profiles so the sandboxed process can no longer modify the user's global git
config (git config can drive command execution via aliases, core.pager,
core.hooksPath, etc.). Read access is unchanged, so normal git operations are
unaffected. Documented in docs/cli/sandbox.md.
diff --git a/docs/cli/sandbox.md b/docs/cli/sandbox.md
@@ -99,17 +99,7 @@ Built-in profiles (set via `SEATBELT_PROFILE` env var):
 - `strict-open`: Read and write restrictions, network allowed
 - `strict-proxied`: Read and write restrictions, network via proxy
 
-<!-- prettier-ignore -->
-> [!NOTE]
-> Under the macOS Seatbelt profiles, `~/.gitconfig` is read-only. The sandbox
-> still allows reading it but no longer grants write access. Your Gemini CLI
-> directory (`~/.gemini`) stays writable because the CLI persists its own
-> runtime state and settings there; as a residual effect, a sandboxed shell
-> command can still write to `~/.gemini`.
->
-> Independently of the sandbox, the agent's file-writing tools (`write_file` and
-> `replace`) now ask for explicit confirmation before they modify a workspace
-> `.gemini/` directory or a `.gitconfig` file, even when auto-accept is enabled.
+Under the macOS Seatbelt profiles, `~/.gitconfig` is read-only: the sandbox still allows reading it but no longer grants write access.
 
 ### 2. Container-based (Docker/Podman)
 
diff --git a/packages/cli/src/utils/sandbox-macos-permissive-open.sb b/packages/cli/src/utils/sandbox-macos-permissive-open.sb
@@ -12,7 +12,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb b/packages/cli/src/utils/sandbox-macos-permissive-proxied.sb
@@ -12,7 +12,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/cli/src/utils/sandbox-macos-restrictive-open.sb b/packages/cli/src/utils/sandbox-macos-restrictive-open.sb
@@ -70,7 +70,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb b/packages/cli/src/utils/sandbox-macos-restrictive-proxied.sb
@@ -70,7 +70,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/cli/src/utils/sandbox-macos-strict-open.sb b/packages/cli/src/utils/sandbox-macos-strict-open.sb
@@ -105,7 +105,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/cli/src/utils/sandbox-macos-strict-proxied.sb b/packages/cli/src/utils/sandbox-macos-strict-proxied.sb
@@ -105,7 +105,6 @@
     (subpath (string-append (param "HOME_DIR") "/.gemini"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
-    ;; ~/.gitconfig is intentionally read-only in the sandbox (no write access).
     ;; Allow writes to included directories from --include-directories
     (subpath (param "INCLUDE_DIR_0"))
     (subpath (param "INCLUDE_DIR_1"))
diff --git a/packages/core/src/safety/built-in.test.ts b/packages/core/src/safety/built-in.test.ts
@@ -308,109 +308,4 @@ describe('AllowedPathChecker', () => {
       }
     });
   });
-
-  describe('Security Regression: .gemini and .gitconfig HITL', () => {
-    it('should require ASK_USER for .gemini paths inside workspace, but deny them if outside, including case, trailing-character, and NTFS ADS bypasses', async () => {
-      const geminiPaths = [
-        path.join(mockCwd, '.gemini', 'settings.json'),
-        path.join(mockCwd, '.gemini', 'settings.JSON'),
-        path.join(mockCwd, '.GEMINI', 'settings.json'),
-        path.join(mockCwd, '.gemini', 'commands', 'custom.toml'),
-        // Windows trailing character bypasses
-        path.join(mockCwd, '.gemini ', 'settings.json'),
-        path.join(mockCwd, '.gemini.', 'settings.json'),
-        // NTFS Alternate Data Stream bypasses
-        path.join(mockCwd, '.gemini::$DATA', 'settings.json'),
-      ];
-
-      for (const p of geminiPaths) {
-        const input = createInput({ path: p });
-        const result = await checker.check(input);
-        expect(result.decision).toBe(SafetyCheckDecision.ASK_USER);
-        expect(result.reason).toContain(
-          'Modifying Gemini CLI configuration files (.gemini) requires explicit user confirmation',
-        );
-      }
-
-      // Verify that paths outside the workspace containing .gemini are strictly denied
-      const outsideGeminiPaths = [
-        path.join(testRootDir, 'outside', '.gemini', 'settings.json'),
-        path.join(testRootDir, 'outside', '.GEMINI', 'settings.json'),
-      ];
-
-      for (const p of outsideGeminiPaths) {
-        const input = createInput({ path: p });
-        const result = await checker.check(input);
-        expect(result.decision).toBe(SafetyCheckDecision.DENY);
-        expect(result.reason).toContain('outside of the allowed workspace');
-      }
-    });
-
-    it('should require ASK_USER for .gitconfig files inside workspace, but deny them if outside, including case, trailing-character, and NTFS ADS bypasses', async () => {
-      const gitConfigPaths = [
-        path.join(mockCwd, '.gitconfig'),
-        path.join(mockCwd, '.GITCONFIG'),
-        path.join(mockCwd, 'nested', '.gitconfig'),
-        // Windows trailing character bypasses
-        path.join(mockCwd, '.gitconfig '),
-        path.join(mockCwd, '.gitconfig.'),
-        // NTFS Alternate Data Stream bypasses
-        path.join(mockCwd, '.gitconfig::$DATA'),
-      ];
-
-      for (const p of gitConfigPaths) {
-        const input = createInput({ path: p });
-        const result = await checker.check(input);
-        expect(result.decision).toBe(SafetyCheckDecision.ASK_USER);
-        expect(result.reason).toContain(
-          'Modifying Git configuration files (.gitconfig) requires explicit user confirmation',
-        );
-      }
-
-      // Verify that .gitconfig outside the workspace is strictly denied
-      const outsideGitConfigPaths = [
-        path.join(testRootDir, 'outside', '.gitconfig'),
-      ];
-
-      for (const p of outsideGitConfigPaths) {
-        const input = createInput({ path: p });
-        const result = await checker.check(input);
-        expect(result.decision).toBe(SafetyCheckDecision.DENY);
-        expect(result.reason).toContain('outside of the allowed workspace');
-      }
-    });
-
-    it('should distinguish the denied .git directory from the confirmable .gitconfig file', async () => {
-      // The `.git` directory remains a hard DENY as a sensitive path.
-      const gitDirResult = await checker.check(
-        createInput({ path: path.join(mockCwd, '.git', 'config') }),
-      );
-      expect(gitDirResult.decision).toBe(SafetyCheckDecision.DENY);
-      expect(gitDirResult.reason).toContain('Access to sensitive path');
-
-      // `.gitconfig` is a distinct file that only requires confirmation.
-      const gitConfigResult = await checker.check(
-        createInput({ path: path.join(mockCwd, '.gitconfig') }),
-      );
-      expect(gitConfigResult.decision).toBe(SafetyCheckDecision.ASK_USER);
-      expect(gitConfigResult.reason).toContain(
-        'Modifying Git configuration files (.gitconfig)',
-      );
-    });
-
-    it('should allow benign siblings such as .gitignore, .geminiignore, and .gitattributes without confirmation', async () => {
-      const benignPaths = [
-        path.join(mockCwd, '.gitignore'),
-        path.join(mockCwd, '.geminiignore'),
-        path.join(mockCwd, 'nested', '.gitignore'),
-        path.join(mockCwd, '.gitattributes'),
-      ];
-
-      for (const p of benignPaths) {
-        const input = createInput({ path: p });
-        const result = await checker.check(input);
-        expect(result.decision).toBe(SafetyCheckDecision.ALLOW);
-      }
-    });
-  });
 });
diff --git a/packages/core/src/safety/built-in.ts b/packages/core/src/safety/built-in.ts
@@ -65,8 +65,6 @@ export class AllowedPathChecker implements InProcessChecker {
       // Check for blocked segments case-insensitively
       let hasBlockedSegment = false;
       let isVscodePath = false;
-      let isGeminiPath = false;
-      let isGitConfigPath = false;
 
       for (const resolvedDir of resolvedAllowedDirs) {
         if (!this.isPathAllowed(resolvedPath, resolvedDir)) continue;
@@ -86,17 +84,6 @@ export class AllowedPathChecker implements InProcessChecker {
           if (clean === '.vscode') {
             isVscodePath = true;
           }
-          // Writes under a `.gemini` directory or to a `.gitconfig` file change
-          // how the CLI and git themselves behave, so they should be a
-          // deliberate, confirmed action rather than an incidental edit.
-          // Note: `.git` is denied above, and siblings such as `.gitignore` or
-          // `.geminiignore` are intentionally not matched here.
-          if (clean === '.gemini') {
-            isGeminiPath = true;
-          }
-          if (clean === '.gitconfig') {
-            isGitConfigPath = true;
-          }
         }
       }
 
@@ -114,20 +101,6 @@ export class AllowedPathChecker implements InProcessChecker {
         };
       }
 
-      if (isGeminiPath) {
-        return {
-          decision: SafetyCheckDecision.ASK_USER,
-          reason: `Modifying Gemini CLI configuration files (.gemini) requires explicit user confirmation.`,
-        };
-      }
-
-      if (isGitConfigPath) {
-        return {
-          decision: SafetyCheckDecision.ASK_USER,
-          reason: `Modifying Git configuration files (.gitconfig) requires explicit user confirmation.`,
-        };
-      }
-
       let isAllowed = false;
       for (const resolvedDir of resolvedAllowedDirs) {
         if (this.isPathAllowed(resolvedPath, resolvedDir)) {
