exec-cwd
Programs run inside the configured root
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain exec-cwd.
- pack
execopt-in pack- weight
- scored
- scope
- server (working directory of started programs)
- decided by
- fs-observer
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
activechecks.exec-cwd.enabledchecks.exec-cwd.severity
Probes
cwdprogram sm-echo records its working directory; it must be inside the sandbox root
Settings and thresholds
Every check also takes checks.exec-cwd.enabled and checks.exec-cwd.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
active | false | not locked | Allow the exec pack and active custom probes to run harness-owned programs. Only the --active flag can set it; files and environment cannot. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Start every program with its working directory fixed to the configured root ({sandbox}), and do not let an argument change it.
False positives
A server configured to start programs elsewhere on purpose is reported as failing; give it {sandbox} as its root.
False negatives
A server that changes directory per call is only seen for the call the harness made.