magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS2012: sandbox required

sandbox.mode is required (or MAGUS_SANDBOX=required, or --sandbox=required), and the kernel cannot confine the processes the run starts. magus stops before running anything.

[MGS2012] sandbox mode is required for /tmp/mergequeue-apply-1/candidate-7/checkout,
and the kernel cannot confine its children: sandbox: kernel sandbox unsupported on this host;
run it on Linux 6.2 or newer with landlock enabled (/sys/kernel/security/landlock)

Why

Without kernel landlock the sandbox falls back to magus's own binding checks (MGS2005). Those confine what goes through magus's bindings, and nothing a subprocess does: a tool writing through a symlink, or any native code, is out of their reach. That fallback is a fair trade for a developer's own build. It is not one for code nobody trusts running in a job that holds a credential, so a caller that needs the kernel's guarantee says so and magus refuses rather than degrade.

required also needs landlock ABI 3 (Linux 6.2) or newer. Below it the kernel cannot deny truncation, so a confined child could still empty any file its user owns, inside the rules or not.

It fires in two places, with the same meaning:

  • when the workspace's sandbox is applied, before any target or script runs;
  • when a child would start under a required policy, so no path starts one unconfined.

Resolution

  • Run on Linux 6.2 or newer with landlock enabled; check that /sys/kernel/security/landlock exists. GitHub's hosted Ubuntu runners have it.
  • Where kernel enforcement is not available and you accept binding-level checks, use best-effort instead.
Sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. magus stdlibReference for every magus stdlib module - fs, os, http, json, yaml, crypto, and the rest of the magusfile API. MGS2004: sandbox config unresolvedFires when a sandbox declaration (magus.yaml's sandbox, a spell's mgs_getSandbox, or a target's sandbox policy) or a passthrough pattern cannot be honored; nothing runs. magus queueList the changes carrying merge intent, plan them into partitions of independent changes, validate speculative candidates, and merge the green ones through the provider.
MGS2012sandboxlandlockkernelrequiredmerge queuefail closed
Last updated (a9ff8609)
Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. Workspace in full.

Target

A named operation (build, test, ...) you invoke with magus run <target>; it may compose a spell's tool-native operations and depend on other targets. Target in full.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). Op in full.

Sandbox

The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free. Sandbox in full.

Tool

An action a model can call through its host: a name, a description, a typed input and a result. magus serves its tools over MCP, each a read of the workspace model or a run of the CLI it already has. Tool in full.

Job

The unit of delegated work, and one row of the job store: what an orchestrating agent handed out, with its goal, the checkpoint it was cut against, the paths it may write or must not touch, and the one check it runs. A job's holder is either a session, for work an orchestrator handed out, or the daemon, for its own maintenance. The store records; the agent guard is what reads those facts back when grading a write. Job in full.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate. Run in full.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.