branderson
5fef8dcf90
The headless-SSH-key feature claimed the plaintext key was "deleted immediately after being loaded into the agent, so nothing readable is left on disk" - but entrypoint.sh only deleted the copy it made; the original bind-mounted source at $SANDBOX_HOME/.ssh-sandbox-key-src stayed mounted, readable, for the container's whole life. Combined with the sandbox user's uid now matching the host user's, that file was directly readable by the very process the sandbox exists to constrain, letting a compromised session exfiltrate the raw key instead of being limited to signing through the local agent socket. Move the mount to /root/.ssh-sandbox-key-src (root:root, 700 by default) so only entrypoint.sh's root-run startup code can ever reach it; the sandbox user has no path to that directory at all. Update the matching static/runtime tests (the runtime one now asserts the sandbox user actually gets permission denied reading the source) and correct the README's description of the mechanism.