# v0.4.0

## New: Landlock LSM defense-in-depth (Linux)

ai-jail now applies [Landlock](https://landlock.io/) filesystem access control as a second security layer on top of bwrap mount namespaces. Landlock restricts what the sandboxed process can do at the VFS level, closing attack vectors that bwrap alone doesn't cover: `/proc` escape routes, symlink tricks within allowed mounts, and namespace bugs.

- Uses ABI V3 (Linux 6.2+) with best-effort degradation to V1 on Linux 5.13+, or silent no-op on older kernels.
- Applied in the parent process after building the bwrap command but before spawning it, so restrictions inherit through fork+exec. If the namespace is somehow escaped, Landlock still protects the host.
- In `--lockdown` mode, Landlock rules are stricter: project is read-only, no home dotdirs, only `/tmp` is writable.
- Enabled by default. Disable with `--no-landlock` or `no_landlock = true` in `.ai-jail` config.

### New CLI flags

| Flag | Description |
|------|-------------|
| `--landlock` | Explicitly enable Landlock (default) |
| `--no-landlock` | Disable Landlock, fall back to bwrap-only |

### New config field

| Field | Type | Default | Description |
|-------|------|---------|-------------|
| `no_landlock` | bool | not set (auto) | `true` disables Landlock LSM |

### Normal mode Landlock rules

| Path | Access |
|------|--------|
| `/usr`, `/bin`, `/sbin`, `/lib`, `/lib64`, `/etc`, `/opt`, `/sys`, `/run` | read-only |
| `/proc`, `/tmp`, `/dev`, `/dev/shm`, project directory | read-write |
| Home dotdirs in DOTDIR_RW list (`.claude`, `.config`, `.cargo`, `.cache`, etc.) | read-write |
| `~/.local`, `~/.claude.json` | read-write |
| `~/.gitconfig` | read-only |
| Other home dotdirs (not in deny list) | read-only |
| Extra `--rw-map` / `--map` paths | read-write / read-only |
| Docker socket, GPU devices (if enabled) | read-write |
| bwrap binary | read+execute |

### Lockdown mode Landlock rules

| Path | Access |
|------|--------|
| System paths + project directory | read-only |
| `/proc`, `/tmp` | read-write |
| No home dotdirs, no extra maps, no Docker, no GPU | — |

## Fixes

- **Fix /lib64 symlink in bwrap sandbox** — The `/lib64` symlink inside the sandbox was pointing to `usr/lib` instead of `usr/lib64`, causing `execvp bash: No such file or directory` on Ubuntu 24.04 and other distros where `/usr/lib64` is a real directory containing the dynamic linker. (Thanks @fevitta, PR #2)

## Backward compatibility

- Old `.ai-jail` configs without the `no_landlock` field parse without error and default to Landlock enabled.
- All existing CLI flags and config fields are unchanged.
